[Dnsmasq-discuss] Testers wanted: DNSSEC.

[Jan-Piet Mens]

> I moved forward to test7, and now the FIRST query (the one shipping the
> RRSIG and other additional stuff) lacks the AD flag, subsequent
> responses carry it.

I cannot confirm that. The first query sets the AD flag (and returns an
RRSIG in the response), and subsequent queries also set AD flag (without
the RRSIGs in the response).

FWIW, I'm using a validating Unbound as upstream resolver, but I've just
tested with a validating BIND, and dnsmasq handles both correctly.

        -JP