Ubuntu
openssh package

  1. Bug #242956
  2. Comment #7

Comment 7 for bug 242956

Revision history for this message
Jonathan Stewart (reaper-fudo) wrote :

In my (limited) experience, the server only responds with the AD bit set which it can validate the DNSSEC records on the domain. As there is no root key in the DNS now, this means you must configure trust anchors on your recursive nameserver.

My question would be: is your recursive DNS server actually able to validate the DNSSEC records? If you operate the server, you should be able to examine the dnssec logs and determine if the nameserver is able to validate the DNSSEC records.