From b7e73edd124df4585bc2b00e2e78f4cac75ed660 Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Thu, 4 Sep 2025 10:21:05 +1000 Subject: [PATCH] test that rrsigs are returned for glue with +cd --- bin/tests/system/dnssec/tests_validation.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/bin/tests/system/dnssec/tests_validation.py b/bin/tests/system/dnssec/tests_validation.py index 88b0a920f1..95d1dbb5c4 100644 --- a/bin/tests/system/dnssec/tests_validation.py +++ b/bin/tests/system/dnssec/tests_validation.py @@ -1344,3 +1344,15 @@ def test_unknown_algorithms(): isctest.check.noerror(res1) isctest.check.noerror(res2) isctest.check.noadflag(res2) + + +def test_rrsigs_for_glue(): + msg = isctest.query.create("ns3.secure.example", "A", cd=True) + res = isctest.query.tcp(msg, "10.53.0.4") + isctest.check.noerror(res) + isctest.check.rr_count_eq(res.answer, 2) + assert any(record.rdtype == rdatatype.A for record in res.answer) + assert any( + record.rdtype == rdatatype.RRSIG and record.covers == rdatatype.A + for record in res.answer + )