Re: trouble with .gov dns?

[Tony Finch <dot () dotat at>]

Florian Weimer <fw () deneb enyo de> wrote:
> > I have "dnssec-enable no;" in my bind config.
>
> It does not seem to have the intended effect.

BIND's interpretation of the DO bit is "I understand DNSSEC RRs so it is
OK to send them" not "I would like you to send DNSSEC RRs". This is why it
always sets the DO bit when it can, i.e. when the request contains an EDNS
OPT pseudo-RR.

Tony.
-- 
f.anthony.n.finch  <dot () dotat at>  http://dotat.at/
Rockall, Malin, Hebrides: South 5 to 7, occasionally gale 8 at first in
Rockall and Malin, veering west or northwest 4 or 5, then backing southwest 5
or 6 later. Rough or very rough. Occasional rain. Moderate or good,
occasionally poor.