1; config options 2server: 3 trust-anchor: "example. DNSKEY 257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )" 4 val-override-date: "20120420235959" 5 target-fetch-policy: "0 0 0 0 0" 6 7stub-zone: 8 name: "." 9 stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. 10CONFIG_END 11 12SCENARIO_BEGIN Test validator NSEC3 B.3 optout unsigned, without nc. 13 14; K.ROOT-SERVERS.NET. 15RANGE_BEGIN 0 100 16 ADDRESS 193.0.14.129 17ENTRY_BEGIN 18MATCH opcode qtype qname 19ADJUST copy_id 20REPLY QR NOERROR 21SECTION QUESTION 22. IN NS 23SECTION ANSWER 24. IN NS K.ROOT-SERVERS.NET. 25SECTION ADDITIONAL 26K.ROOT-SERVERS.NET. IN A 193.0.14.129 27ENTRY_END 28 29ENTRY_BEGIN 30MATCH opcode subdomain 31ADJUST copy_id copy_query 32REPLY QR NOERROR 33SECTION QUESTION 34example. IN A 35SECTION AUTHORITY 36example. IN NS ns1.example. 37; leave out to make unbound take ns1 38;example. IN NS ns2.example. 39SECTION ADDITIONAL 40ns1.example. IN A 192.0.2.1 41; leave out to make unbound take ns1 42;ns2.example. IN A 192.0.2.2 43ENTRY_END 44RANGE_END 45 46; ns1.example. 47RANGE_BEGIN 0 100 48 ADDRESS 192.0.2.1 49ENTRY_BEGIN 50MATCH opcode qtype qname 51ADJUST copy_id copy_query 52REPLY QR REFUSED 53SECTION QUESTION 54ns1.example. IN A 55SECTION ANSWER 56ENTRY_END 57 58ENTRY_BEGIN 59MATCH opcode qtype qname 60ADJUST copy_id copy_query 61REPLY QR REFUSED 62SECTION QUESTION 63ns1.example. IN AAAA 64SECTION ANSWER 65ENTRY_END 66 67ENTRY_BEGIN 68MATCH opcode qtype qname 69ADJUST copy_id copy_query 70REPLY QR REFUSED 71SECTION QUESTION 72example. IN NS 73SECTION ANSWER 74ENTRY_END 75 76; response to DNSKEY priming query 77 78ENTRY_BEGIN 79MATCH opcode qtype qname 80ADJUST copy_id 81REPLY QR NOERROR 82SECTION QUESTION 83example. IN DNSKEY 84SECTION ANSWER 85example. DNSKEY 256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= ) 86example. DNSKEY 257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= ) 87example. RRSIG DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example. AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== ) 88ENTRY_END 89 90ENTRY_BEGIN 91MATCH opcode qtype qname 92ADJUST copy_id 93REPLY QR AA DO NOERROR 94SECTION QUESTION 95c.example. IN DS 96SECTION AUTHORITY 97;; NSEC3 RR that covers the "next closer" name (c.example) 98;; H(c.example) = 4g6p9u5gvfshp30pqecj98b3maqbn1ck 99;35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG ) 100;35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example. g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== ) 101 102;; NSEC3 RR that matches the closest encloser (example) 103;; H(example) = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom 1040p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG ) 1050p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example. OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== ) 106ENTRY_END 107 108ENTRY_BEGIN 109MATCH opcode subdomain 110ADJUST copy_id copy_query 111REPLY QR AA DO NOERROR 112SECTION QUESTION 113c.example. IN MX 114SECTION AUTHORITY 115c.example. NS ns1.c.example. 116c.example. NS ns2.c.example. 117 118;; NSEC3 RR that covers the "next closer" name (c.example) 119;; H(c.example) = 4g6p9u5gvfshp30pqecj98b3maqbn1ck 120; 35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG ) 121; 35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example. g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== ) 122 123;; NSEC3 RR that matches the closest encloser (example) 124;; H(example) = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom 1250p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG ) 1260p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example. OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== ) 127 128SECTION ADDITIONAL 129ns1.c.example. A 192.0.2.7 130ns2.c.example. A 192.0.2.8 131 132ENTRY_END 133 134RANGE_END 135 136; ns1.c.example. 137RANGE_BEGIN 0 100 138 ADDRESS 192.0.2.7 139ENTRY_BEGIN 140MATCH opcode qtype qname 141ADJUST copy_id 142REPLY QR AA REFUSED 143SECTION QUESTION 144ns1.c.example. IN AAAA 145ENTRY_END 146 147ENTRY_BEGIN 148MATCH opcode qtype qname 149ADJUST copy_id 150REPLY QR AA REFUSED 151SECTION QUESTION 152ns2.c.example. IN AAAA 153ENTRY_END 154 155ENTRY_BEGIN 156MATCH opcode qtype qname 157ADJUST copy_id 158REPLY QR AA NOERROR 159SECTION QUESTION 160c.example. IN NS 161SECTION ANSWER 162c.example. NS ns1.c.example. 163c.example. NS ns2.c.example. 164SECTION ADDITIONAL 165ns1.c.example. A 192.0.2.7 166ns2.c.example. A 192.0.2.8 167ENTRY_END 168 169ENTRY_BEGIN 170MATCH opcode qtype qname 171ADJUST copy_id 172REPLY QR AA NOERROR 173SECTION QUESTION 174mc.c.example. IN MX 175SECTION ANSWER 176mc.c.example. IN MX 50 mx.c.example. 177SECTION AUTHORITY 178c.example. NS ns1.c.example. 179c.example. NS ns2.c.example. 180SECTION ADDITIONAL 181ns1.c.example. A 192.0.2.7 182ns2.c.example. A 192.0.2.8 183ENTRY_END 184RANGE_END 185 186; ns2.c.example. 187RANGE_BEGIN 0 100 188 ADDRESS 192.0.2.8 189ENTRY_BEGIN 190MATCH opcode qtype qname 191ADJUST copy_id 192REPLY QR AA REFUSED 193SECTION QUESTION 194ns1.c.example. IN AAAA 195ENTRY_END 196 197ENTRY_BEGIN 198MATCH opcode qtype qname 199ADJUST copy_id 200REPLY QR AA REFUSED 201SECTION QUESTION 202ns2.c.example. IN AAAA 203ENTRY_END 204 205ENTRY_BEGIN 206MATCH opcode qtype qname 207ADJUST copy_id 208REPLY QR AA NOERROR 209SECTION QUESTION 210c.example. IN NS 211SECTION ANSWER 212c.example. NS ns1.c.example. 213c.example. NS ns2.c.example. 214SECTION ADDITIONAL 215ns1.c.example. A 192.0.2.7 216ns2.c.example. A 192.0.2.8 217ENTRY_END 218 219ENTRY_BEGIN 220MATCH opcode qtype qname 221ADJUST copy_id 222REPLY QR AA NOERROR 223SECTION QUESTION 224mc.c.example. IN MX 225SECTION ANSWER 226mc.c.example. IN MX 50 mx.c.example. 227SECTION AUTHORITY 228c.example. NS ns1.c.example. 229c.example. NS ns2.c.example. 230SECTION ADDITIONAL 231ns1.c.example. A 192.0.2.7 232ns2.c.example. A 192.0.2.8 233ENTRY_END 234RANGE_END 235 236 237STEP 1 QUERY 238ENTRY_BEGIN 239REPLY RD 240SECTION QUESTION 241mc.c.example. IN MX 242ENTRY_END 243 244; recursion happens here. 245STEP 10 CHECK_ANSWER 246ENTRY_BEGIN 247MATCH all 248REPLY QR RD RA SERVFAIL 249SECTION QUESTION 250mc.c.example. IN MX 251ENTRY_END 252 253SCENARIO_END 254