1; config options 2; The island of trust is at testzone.nlnetlabs.nl 3server: 4 trust-anchor: "testzone.nlnetlabs.nl. IN DS 2926 8 2 6f8512d1e82eecbd684fc4a76f39f8c5b411af385494873bdead663ddb78a88b" 5 val-override-date: "20180213111425" 6 target-fetch-policy: "0 0 0 0 0" 7 qname-minimisation: "no" 8 trust-anchor-signaling: no 9 aggressive-nsec: yes 10 domain-insecure: "ant.testzone.nlnetlabs.nl" 11 12stub-zone: 13 name: "testzone.nlnetlabs.nl" 14 stub-addr: 185.49.140.60 15stub-zone: 16 name: "ant.testzone.nlnetlabs.nl" 17 stub-addr: 185.49.140.61 18CONFIG_END 19 20SCENARIO_BEGIN Test to not do aggressive NSEC for domains under NTA 21 22; testzone.nlnetlabs.nl nameserver 23RANGE_BEGIN 0 100 24 ADDRESS 185.49.140.60 25 26; response to DNSKEY priming query 27ENTRY_BEGIN 28MATCH opcode qtype qname 29ADJUST copy_id 30REPLY QR NOERROR 31SECTION QUESTION 32testzone.nlnetlabs.nl. IN DNSKEY 33SECTION ANSWER 34testzone.nlnetlabs.nl. 3600 IN DNSKEY 256 3 8 AwEAAbrNEg01ByEpUUiip+GNAkNVjUfeX7sl9kPUssR3JQvhCJWVs7aBY0Ae1cNtQWgzCmidGorlXvEY2nNBiMM4l7IXqopJsgyj+Cb3nQPVLi/7yVwUb+AIwSJw1gRFElMYonsMOL9qUrJi8BBCnCR0EqkL+X4slmtkXSJbzQAwvHI7 35testzone.nlnetlabs.nl. 3600 IN DNSKEY 257 3 8 AwEAAbn0eGV0wqMBQNSVTY//BoiOD7bexC7FcVv0fH9bwjKOA8I+ob377E14vZN2xRLC2b1GG5iBckjeI+N2dB9eC2KRnScU3Gbmtw75BBYfm/y4Hu72zEjEZ0ZGv6gjSZRv/1o87ODAwQaxN8/dQD+5U/5xu12XM39bCJZx2GWTbf5L 36testzone.nlnetlabs.nl. 3600 IN RRSIG DNSKEY 8 3 3600 20180313101254 20180213101254 2926 testzone.nlnetlabs.nl. gSLZb/dSKutRlAKSo8ZCC1R+SkvABMYBRQsms77WPfYCDbt5GbXeuGqwGdadjEN8gGSU+qrYNxBZRhlYY6d2vtl+DGh67qwteHSwOCw0VvU64eVh38maJA1U673U4JtlBALzBOA/UHmXPlCgPPoW3BG0U3T2Qir/mqOmegmpBcw= 37SECTION AUTHORITY 38testzone.nlnetlabs.nl. 3600 IN NS ns.nlnetlabs.nl. 39testzone.nlnetlabs.nl. 3600 IN RRSIG NS 8 3 3600 20180313102201 20180213102201 44940 testzone.nlnetlabs.nl. Ox0iKc+z3i1qR1wMr8TBPYzuYO5UTaLrBsDagJAd25fvCkGN+h3HPmWlCIW0cBHsS+IaHXr1JhWutjSCc4UBcY+sT7Y7Fw3V1qdZW2KzbSgWUyPkTXoYcIIVLacSUTXEyltW6jj61WEI/RaUGUCJortvwH5iv1Hzee343isxObI= 40SECTION ADDITIONAL 41ENTRY_END 42 43; response for antelope.testzone.nlnetlabs.nl. 44ENTRY_BEGIN 45MATCH opcode qtype qname 46ADJUST copy_id 47REPLY QR NXDOMAIN 48SECTION QUESTION 49antelope.testzone.nlnetlabs.nl. IN TXT 50SECTION ANSWER 51SECTION AUTHORITY 52testzone.nlnetlabs.nl. 3600 IN NSEC alligator.testzone.nlnetlabs.nl. NS SOA RRSIG NSEC DNSKEY 53testzone.nlnetlabs.nl. 3600 IN RRSIG NSEC 8 3 3600 20180313102201 20180213102201 44940 testzone.nlnetlabs.nl. gTKn6U1nal9oA79IRxLa/7zexl6A0yJZzeEGBbZ5rh5feyAr2X4LTR9bPCgcHeMVggf4FP+kD1L/sxzj/YLwB1ZKGKlwnzsHtPFTlmvDClaqQ76DRZq5Vejr2ZfnclBUb2vtxaXywTRW8oueaaq9flcShEQ/cQ+KRU8sc344qd0= 54alligator.testzone.nlnetlabs.nl. 3600 IN NSEC cheetah.testzone.nlnetlabs.nl. TXT RRSIG NSEC 55alligator.testzone.nlnetlabs.nl. 3600 IN RRSIG NSEC 8 4 3600 20180313102201 20180213102201 44940 testzone.nlnetlabs.nl. QAgQ0AsMoYG02+VPfoOctSPlTHdQOkQt5fFkSkzIbVhUzNOqa+dB/Qkc81AwFeJosA+PvYjt6utcVkIWmK2Djy9eXC49gILtVF79vUe4G7ZrybO5NXjqNa5ANoUGM+yew4wkjeNOMVAsvs+1kvFY7S8RAa/0AIYlZHQ8vNBPNaI= 56testzone.nlnetlabs.nl. 3600 IN SOA ns.nlnetlabs.nl. ralph.nlnetlabs.nl. 1 14400 3600 604800 3600 57testzone.nlnetlabs.nl. 3600 IN RRSIG SOA 8 3 3600 20180313102201 20180213102201 44940 testzone.nlnetlabs.nl. GhmXNFQktZIgaBpGKwj9Q2mfq5+jcbRPK+PPgtRVicUPZga/d/iGEL8PV/8DzGwkaZbM14pamSUMgdJibW4zNhLz/ukjPilbjoj6giH1jtbdZLAQ6iK9pZ/4jKUEq4txviTczZNnDeolgPEEl4xo4NclQmi7zj1XBlQRbjvG0/0= 58SECTION ADDITIONAL 59ENTRY_END 60 61RANGE_END 62 63; ant.testzone.nlnetlabs.nl nameserver 64RANGE_BEGIN 0 100 65 ADDRESS 185.49.140.61 66 67ENTRY_BEGIN 68MATCH opcode qtype qname 69ADJUST copy_id 70REPLY QR NOERROR 71SECTION QUESTION 72ant.testzone.nlnetlabs.nl. IN TXT 73SECTION ANSWER 74ant.testzone.nlnetlabs.nl. 10 IN TXT "domain under NTA" 75ENTRY_END 76RANGE_END 77 78STEP 1 QUERY 79ENTRY_BEGIN 80REPLY RD DO 81SECTION QUESTION 82antelope.testzone.nlnetlabs.nl. IN TXT 83ENTRY_END 84 85; recursion happens here. 86STEP 10 CHECK_ANSWER 87ENTRY_BEGIN 88MATCH all 89REPLY QR RD RA DO AD NXDOMAIN 90SECTION QUESTION 91antelope.testzone.nlnetlabs.nl. IN TXT 92SECTION ANSWER 93SECTION AUTHORITY 94testzone.nlnetlabs.nl. 3600 IN NSEC alligator.testzone.nlnetlabs.nl. NS SOA RRSIG NSEC DNSKEY 95testzone.nlnetlabs.nl. 3600 IN RRSIG NSEC 8 3 3600 20180313102201 20180213102201 44940 testzone.nlnetlabs.nl. gTKn6U1nal9oA79IRxLa/7zexl6A0yJZzeEGBbZ5rh5feyAr2X4LTR9bPCgcHeMVggf4FP+kD1L/sxzj/YLwB1ZKGKlwnzsHtPFTlmvDClaqQ76DRZq5Vejr2ZfnclBUb2vtxaXywTRW8oueaaq9flcShEQ/cQ+KRU8sc344qd0= 96alligator.testzone.nlnetlabs.nl. 3600 IN NSEC cheetah.testzone.nlnetlabs.nl. TXT RRSIG NSEC 97alligator.testzone.nlnetlabs.nl. 3600 IN RRSIG NSEC 8 4 3600 20180313102201 20180213102201 44940 testzone.nlnetlabs.nl. QAgQ0AsMoYG02+VPfoOctSPlTHdQOkQt5fFkSkzIbVhUzNOqa+dB/Qkc81AwFeJosA+PvYjt6utcVkIWmK2Djy9eXC49gILtVF79vUe4G7ZrybO5NXjqNa5ANoUGM+yew4wkjeNOMVAsvs+1kvFY7S8RAa/0AIYlZHQ8vNBPNaI= 98testzone.nlnetlabs.nl. 3600 IN SOA ns.nlnetlabs.nl. ralph.nlnetlabs.nl. 1 14400 3600 604800 3600 99testzone.nlnetlabs.nl. 3600 IN RRSIG SOA 8 3 3600 20180313102201 20180213102201 44940 testzone.nlnetlabs.nl. GhmXNFQktZIgaBpGKwj9Q2mfq5+jcbRPK+PPgtRVicUPZga/d/iGEL8PV/8DzGwkaZbM14pamSUMgdJibW4zNhLz/ukjPilbjoj6giH1jtbdZLAQ6iK9pZ/4jKUEq4txviTczZNnDeolgPEEl4xo4NclQmi7zj1XBlQRbjvG0/0= 100SECTION ADDITIONAL 101ENTRY_END 102 103; query for ant.testzone.nlnetlabs.nl, which is below an NTA 104STEP 20 QUERY 105ENTRY_BEGIN 106REPLY RD DO 107SECTION QUESTION 108ant.testzone.nlnetlabs.nl. IN TXT 109ENTRY_END 110 111STEP 30 CHECK_ANSWER 112ENTRY_BEGIN 113MATCH all 114REPLY QR RD RA DO NOERROR 115SECTION QUESTION 116ant.testzone.nlnetlabs.nl. IN TXT 117SECTION ANSWER 118ant.testzone.nlnetlabs.nl. 10 IN TXT "domain under NTA" 119ENTRY_END 120 121SCENARIO_END 122