Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having a local caching DNS server: Unbound:

[root@localhost /etc/unbound] cat unbound.conf
    access-control: allow 
    verbosity: 1
    harden-referral-path: yes  
    use-caps-for-id: yes
    prefetch: yes  
    prefetch-key: yes
[root@localhost /etc/unbound] 

Rebooted the notebook, cleaned the browser, and go to:


it says:

No, your DNS resolver does NOT validate DNSSEC signatures.

..What am I missing?

UPDATE: http://dnssectest.sidn.nl/ - says this too.. according to "dig" I'm using for DNS server..

I tried service iptables stop..didn't worked.

BTW, why do stackexchange look like this ( http://i.imgur.com/4eTxo3M.png ) when I'm using a local DNS cache?

share|improve this question
BTW because your local DNS cache is failing to resolve the server used for StackOverflow's CSS. Install Firebug on Firefox and look at the HTTP tab. – sourcejedi Jul 13 '13 at 16:54
Where did you get unbound from? I'm wondering if you're lacking the public keys... – sourcejedi Jul 13 '13 at 16:55
I got it from the EPEL repo – gasko peter Jul 13 '13 at 17:02
"BTW" - how can I resolv this issue? why doesn't it resolves it? :D – gasko peter Jul 13 '13 at 17:02
"BTW" - Manpage says you can set verbose: 3 to get per-query information into the log. Or start by finding what the failing domain is and then running dig manually to see the result code. – sourcejedi Jul 13 '13 at 17:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.