[Opendnssec-user] ods-signerd warning instead of failure on occluded data

[Dave Knight]

On 2011-01-31, at 6:42 AM, Billy Glynn wrote:

> Hi,
> 
> We're testing OpenDNSSEC signer engine version 1.3.0-trunk
> 
> We're receiving occluded data errors for the ie zone as follows:
> 
> Jan 31 11:22:20 ods-test ods-signerd: occluded data at
> banba.domainregistry.ie. (below domainregistry.ie. NS)
> Jan 31 11:22:20 ods-test ods-signerd: occluded data at
> gns1.domainregistry.ie. (below domainregistry.ie. NS)
> Jan 31 11:22:20 ods-test ods-signerd: occluded data at
> gns2.domainregistry.ie. (below domainregistry.ie. NS)
> Jan 31 11:22:20 ods-test ods-signerd: occluded data at b.iedr.ie. (below
> iedr.ie. NS)
> Jan 31 11:22:20 ods-test ods-signerd: update zone ie failed: zone data
> contains errors
> Jan 31 11:22:20 ods-test ods-signerd: task [update zone ie] failed
> 
> Ideally, we would prefer to not have to change the glue in our TLD zone.
> 
> Would it be possible to warn about occluded data and continue signing,
> instead of failing the process?

I didn't see an answer to this on-list, am also interested in to see if there will be an easier way to apply this local policy than modifying the source code. Alternatively an explanation of why this shouldn't be possible would be good.

dave