implement bits of +do auth querying
oneshot validator, checks RRSIG A against DNSKEY, no chain
oneshot now validates various valid things, and rejects www.dnssec-failed.org. Unsure whether we are doing KSK/ZSK splits correctly.
now only returns DS-checked DNSKEY, exposing that we indeed skipped part of the chain
now validates full chain (DS/KSK/ZSK), terrible recursion length for dnssec-failed.org
log outgoing queries
initial validator design doc
clarify
partial implementation of topdown iterator/validator
doc update
nit
now validates DS/DNSKEY chain down from root to target - ignores NSECs
snapshot
partial NSEC3 support, can correctly declare some subtrees bogus or insecure
now actually validates the desired question, including Bogus state
hack in graphviz output
nit
allow root anchor override
add local testbed, inspired by the sidnlabs workbench. after config.py, run with "named -c named.conf -g -p 5300"
pick up non-optout insecure delegations as well (nsec3)