<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; "><div><div>Hi there.</div><div><br></div><div>I am trying to use PowerDNS -> OpenDNSSEC (signing) -> PowerDNS (slaves) as PowerDNS at the moment is not (IMHO) not good enough yet to do the signing/roll overs etc at the moment.</div><div><br></div><div>Reading: <a href="http://comments.gmane.org/gmane.network.dns.opendnssec.user/631">http://comments.gmane.org/gmane.network.dns.opendnssec.user/631</a></div><div><br></div><div>On the slave if I do a pdns_control retrieve <domain> it sends a notify without the AA bit set</div><div><br></div><div>So opendnssec errors on it.</div><div><br></div><div>This is set as they read RFC 1996 BUT RFC 5936 says for an AXFR Query 2.1.1</div><div><br></div><div>The AA bit <span class="Apple-style-span" style="font-family: monospace; font-size: 16px; white-space: pre; ">"n/a" -- The value in this field has no meaning in the context of</span></div><span class="Apple-style-span" style="font-family: Times; font-size: 16px; "><pre class="newpage" style="font-size: 1em; margin-top: 0px; margin-bottom: 0px; page-break-before: always; "> AXFR query messages. For the client, it is RECOMMENDED that the
value be zero. The server MUST ignore this value.</pre><pre class="newpage" style="font-size: 1em; margin-top: 0px; margin-bottom: 0px; page-break-before: always; "><br></pre></span><div>So.. RFC 1996 is old and RFC 5936 is right so commenting out the check for the AA for a slave retrieving the zone on opendnssec should be done?</div><div><br></div><div>Comments or Am I reading this completely wrong?</div><div><br></div><div>Thanks</div><div>Craig</div></div><div><br></div></body></html>