Re: DNSSSEC verification example

[Brian W. <bwe...@xb...>]

On Oct 30, 2011, at 3:11 PM, Adam Fisk wrote:

> Can anyone provide a quick example of verifying a DNSSEC response on the
> client side. I can't seem to find good documentation on how to do this.

There isn't really a such thing as "a DNSSEC response", so I'm not completely sure what you're looking for.  DNSSEC signs DNS records, not DNS messages.

A response from a signed zone will (typically) contain one or more RRSIG records, signing the data records, which comprise an RRset.  If you have the public key (which won't be in the response), 
then you can call DNSSEC.verify(rrset, rrsig, pubkey).  The data and signature RRsets can be obtained from Message.getSectionRRsets() on the response, and the matching signature can be found by comparing the results of getFootprint() on the public key (DNSKEY) and signature (RRSIG).

I don't think it's possible to come up with a quick example of all of this, as it's not trivial.

Brian