Zitat von Andreas Schulze <andreas.schulze at datev.de>: > Hello, > > I have a remote system as resolver using unbound-1.4.7. > On my local system I configured unbound-1.4.7 also as forwarder to > the remote system. > > --- snip > forward-zone: > name: "." > # 192.0.2.53 is the remote resolver > forward-addr: 192.0.2.53 > --- snap > > Resolving at all works fine. > > On my local system I have the The DNSSEC Validator Plugin from > dnssec-validator.cz > installed. If I configure this Plugin to use the remote server as Resolver > then the Plugin shows me a green label in Firefox for dnssec-validator.cz. > > If I configure the Plugin to use the local Resolver, the > Validatorplugin shows me > a yellow label saying "The domain name is secured with DNSSEC technology, > but the DNS server resolver used cannot verify the signature validity." > > I'm unsure, if this is an Error in the Plugin or I have misconfigured > my forwarding unbound. > > any hints ? > > Thanks > Andreas Hello You could start by checking "by-hand" eg. with dig @remote-resolver some-secured.site +dnssec and dig @local-resolver some-secured.site +dnssec If you get the "ad" in the resulting dig output DNSSEC validation succeed. ; <<>> DiG 9.4.2-P2.1 <<>> @127.0.0.1 dnssec-validator.cz A +dnssec ; (1 server found) ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38884 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 4, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 4096 ;; QUESTION SECTION: ;dnssec-validator.cz. IN A ;; ANSWER SECTION: dnssec-validator.cz. 6829 IN A 217.31.205.50 dnssec-validator.cz. 6829 IN RRSIG A 5 2 7200 20101214170301 20101130170301 29165 dnssec-validator.cz. BuwS/JyQDPYg3i8VHJslEOPSa/znhsOfne03I3RvyVx0cutXFj2a+ddc rEA0fC6abDZr3njhTlcwdJS11Mcl3ObHKGBY1445DaG8jUtncgAN1v+R MeN6S1QeJsTuyWuwrA7oOv66U8Okl6xXTX6Sn58AGdImIipetvSJW1fj t/M= ;; AUTHORITY SECTION: dnssec-validator.cz. 6822 IN NS d.ns.nic.cz. dnssec-validator.cz. 6822 IN NS b.ns.nic.cz. dnssec-validator.cz. 6822 IN NS a.ns.nic.cz. dnssec-validator.cz. 6841 IN RRSIG NS 5 2 7200 20101214170301 20101130170301 29165 dnssec-validator.cz. HggDIcJc5TOozaazxWKg3KWo3EISMRsRH+ZLVR65nW9vE5zNrMaFYIPU lqwMDH390beC52WFJG0kRNzx/s7xxuZ8UW9oZsFEWUAuXZfC59xlsk+0 AzDN6FD/Q9MNqXBAZgfIlSdkkBZWMzXAJfaUj90PIvLJ0V2o+nluiFl4 4dw= Regards Andreas