Re: AW: Disable DNSSEC Validation for selected Domains

2015-01-14 Thread Warren Kumari
NSEC. W On Wed, Jan 14, 2015 at 5:12 PM, Stuart Browne wrote: >> Unfortunately we can't sign the fictional TLD, since we are neither master >> nor slave of the zone. >> We are just forwarding our queries to a foreign authorative Server. >> >> Grüße, >> Stefan > > If the zone isn't signed, it shou

RE: AW: Disable DNSSEC Validation for selected Domains

2015-01-14 Thread Stuart Browne
> Unfortunately we can't sign the fictional TLD, since we are neither master > nor slave of the zone. > We are just forwarding our queries to a foreign authorative Server. > > Grüße, > Stefan If the zone isn't signed, it shouldn't be trying to validate it as there's nothing to validate. Unless

Re: AW: Disable DNSSEC Validation for selected Domains

2015-01-14 Thread Graham Clinch
On 14/01/2015 09:34, stefan.las...@t-systems.com wrote: > Our customer uses a fictional Toplevel Domain[...] Can you flip the problem on its head, by signing the fictional TLD and deploying managed-keys (or trusted-keys) on the validating resolvers? Graham ___