Модульні уроки (4/4)
Secure, insecure e bogus
Secure, insecure, and bogus
“Secure” means the resolver built and verified a valid chain of trust for the answer. “Insecure” means the name is not protected by a DNSSEC chain—for example, because no DS delegates it as secure. “Bogus” means validation was expected but failed, such as a mismatched DS or an invalid or expired signature.
The difference matters for users: a validating resolver may return SERVFAIL for bogus data rather than silently accept it. That protects integrity but can make a signing mistake look like an outage. Compare validating and non-validating observations only as a diagnostic clue; do not disable validation as a permanent fix.
Follow the chain: trust anchor → DS in the parent → DNSKEY in the child → RRSIG for the RRset. Find the first link that does not verify.
Check your understanding
Choose the best answer. This quiz runs locally and sends no DNS queries to real domains.
A DS exists but the RRSIG is invalid. Which state fits?