Lutz Donnerhacke <l...@iks-jena.de> wrote: > * Tony Finch wrote: > > Sure. Zone cuts are very subtle :-) The basic principle is that the parent > > zone is not authoritative for any data at or below the cut, except for the > > DNSSEC records (DS + RRSIG, NSEC + RRSIG). > > Be careful: The parent zone is responsible for DS (+ RRSIG). > NSEC (+ RRSIG) exists authoritivly on both sites of the zone cut.
You are right, I should have been clearer. Note that NSEC3(+RRSIG) does not appear at the zone cut :-) Tony. -- f.anthony.n.finch <d...@dotat.at> http://dotat.at/ Hebrides: Southwest veering northwest 5 or 6. Rough or very rough. Showers. Good. _______________________________________________ dns-operations mailing list dns-operations@lists.dns-oarc.net https://lists.dns-oarc.net/mailman/listinfo/dns-operations dns-jobs mailing list https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
