Brocade Communications Systems ServerIron ADX 12.4.00 Manual Manual page 125

1. LDNS sends a normal type A request with the DO bit set to the mydnssec.com ADNS
2. If the ADNS supports DNSSEC, the response has the DO bit set and a RRSIG record for the
3. The LDNS will then fetch the DNSKEY used in the RRSIG from the ADNS
4. DNSKEY validation at the LDNS occurs as follows:
ServerIron ADX Global Server Load Balancing Guide
53-1002437-01
response RRset in the answer section
•
It is configured to trust the DNSKEY for the root (.).
•
It fetches the DS record for the .com zone from the root.
•
It fetches the DNSKEY for the .com zone from the .com name server. This DNSKEY would
be validated by checking against the signed hash in the DS record from the previous step.
•
It fetches the DS record for the mydnssec.com zone from the .com nameserver
•
This DS record validates the DNSKEY that was obtained from the mydnssec.com ADNS
1
DNSSEC
113