1; config options 2server: 3 trust-anchor: "example. DNSKEY 257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )" 4 val-override-date: "20120420235959" 5 target-fetch-policy: "0 0 0 0 0" 6 fake-sha1: yes 7 trust-anchor-signaling: no 8 9stub-zone: 10 name: "." 11 stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. 12CONFIG_END 13 14SCENARIO_BEGIN Test validator NSEC3 B.2 no data, without NSEC3. 15 16; K.ROOT-SERVERS.NET. 17RANGE_BEGIN 0 100 18 ADDRESS 193.0.14.129 19ENTRY_BEGIN 20MATCH opcode qtype qname 21ADJUST copy_id 22REPLY QR NOERROR 23SECTION QUESTION 24. IN NS 25SECTION ANSWER 26. IN NS K.ROOT-SERVERS.NET. 27SECTION ADDITIONAL 28K.ROOT-SERVERS.NET. IN A 193.0.14.129 29ENTRY_END 30 31ENTRY_BEGIN 32MATCH opcode subdomain 33ADJUST copy_id copy_query 34REPLY QR NOERROR 35SECTION QUESTION 36example. IN A 37SECTION AUTHORITY 38example. IN NS ns1.example. 39; leave out to make unbound take ns1 40;example. IN NS ns2.example. 41SECTION ADDITIONAL 42ns1.example. IN A 192.0.2.1 43; leave out to make unbound take ns1 44;ns2.example. IN A 192.0.2.2 45ENTRY_END 46RANGE_END 47 48; ns1.example. 49RANGE_BEGIN 0 100 50 ADDRESS 192.0.2.1 51ENTRY_BEGIN 52MATCH opcode qtype qname 53ADJUST copy_id copy_query 54REPLY QR REFUSED 55SECTION QUESTION 56ns1.example. IN A 57SECTION ANSWER 58ENTRY_END 59 60ENTRY_BEGIN 61MATCH opcode qtype qname 62ADJUST copy_id copy_query 63REPLY QR REFUSED 64SECTION QUESTION 65ns1.example. IN AAAA 66SECTION ANSWER 67ENTRY_END 68 69ENTRY_BEGIN 70MATCH opcode qtype qname 71ADJUST copy_id copy_query 72REPLY QR REFUSED 73SECTION QUESTION 74example. IN NS 75SECTION ANSWER 76ENTRY_END 77 78; response to DNSKEY priming query 79 80ENTRY_BEGIN 81MATCH opcode qtype qname 82ADJUST copy_id 83REPLY QR NOERROR 84SECTION QUESTION 85example. IN DNSKEY 86SECTION ANSWER 87example. DNSKEY 256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= ) 88example. DNSKEY 257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= ) 89example. RRSIG DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example. AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== ) 90ENTRY_END 91 92; response to DS query 93ENTRY_BEGIN 94MATCH opcode qtype qname 95ADJUST copy_id 96REPLY QR AA DO NOERROR 97SECTION QUESTION 98ns1.example. IN DS 99ENTRY_END 100 101ENTRY_BEGIN 102MATCH opcode qtype qname 103ADJUST copy_id 104REPLY QR AA DO NOERROR 105SECTION QUESTION 106ns1.example. IN MX 107SECTION AUTHORITY 108example. SOA ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 ) 109example. RRSIG SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example. Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== ) 110 111;; NSEC3 RR matches the QNAME and shows that the MX type bit is not set. 112;2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. NSEC3 1 1 12 aabbccdd ( 2vptu5timamqttgl4luu9kg21e0aor3s A RRSIG ) 113;2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example. OmBvJ1Vgg1hCKMXHFiNeIYHK9XVW0iLDLwJN 4TFoNxZuP03gAXEI634YwOc4YBNITrj413iq NI6mRk/r1dOSUw== ) 114 115SECTION ADDITIONAL 116ENTRY_END 117 118RANGE_END 119 120STEP 1 QUERY 121ENTRY_BEGIN 122REPLY RD DO 123SECTION QUESTION 124ns1.example. IN MX 125ENTRY_END 126 127; recursion happens here. 128STEP 10 CHECK_ANSWER 129ENTRY_BEGIN 130MATCH all 131REPLY QR RD RA DO SERVFAIL 132SECTION QUESTION 133ns1.example. IN MX 134SECTION ANSWER 135SECTION AUTHORITY 136SECTION ADDITIONAL 137ENTRY_END 138 139SCENARIO_END 140