我正在研究这个 Deterlab练习，并且在将DNSSEC添加到绑定时遇到了一些问题。 服务器运行BIND 9.7.0-P1。 我所做的configuration如下：google.com的签名区域：
zonesigner -genkeys google.com google.com下添加了署名为named.conf.local的文件。
添加到named.conf.options中：
dnssec-enabled yes; dnssec-validation yes;
添加到named.conf中：
include "/etc/bind/bind.keys";
用bind.keys：
trusted-keys { . 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0="; };
所有文件都使用named-checkconf编译。 当我重新启动绑定并运行挖我仍然没有得到AD位：
sudo dig +dnssec www.google.com A ; <<>> DiG 9.7.0-P1 <<>> +dnssec www.google.com A ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20641 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 3 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 4096 ;; QUESTION SECTION: ;www.google.com. IN A ;; ANSWER SECTION: www.google.com. 10 IN A 10.1.2.155 www.google.com. 10 IN RRSIG A 5 3 10 20160512120048 20160412120048 34206 google.com. QPVwvcsE5VXvMxnhS8/7LDwBWoTopQAuFPaRBeOSlARwTJkuReNgmqoL GcDD++zgS536YlrLGqAr+06fl2fnnnxtfwZUu6pwVmeosnmsU8b3Jd+b domXH138Ob1cBuS7Z5KDI94LkBfTu0ksFEBfcs7lCtvyY9zMw7BWhQ2L lnU= ;; AUTHORITY SECTION: google.com. 604800 IN NS ns.google.com. google.com. 604800 IN RRSIG NS 5 2 604800 20160512120048 20160412120048 34206 google.com. qnx8xI4qYfGBZ3GygxdCrgdoA7x8YwlYYVWPOntQax6Jzhof0V8FgQR6 FqXVVyOeA9aapVimYh45tI42WJ2DyNc8GgCX3xKwPdlmf3zrQqRKcr9F L/6tlLu+ZjBxPbQamLXueXM6m9eFSp9OMqj4EqDCCCA3fzXCkakQyv6P uIw= ;; ADDITIONAL SECTION: ns.google.com. 10 IN A 10.1.2.3 ns.google.com. 10 IN RRSIG A 5 3 10 20160512120048 20160412120048 34206 google.com. ajOz8/kjZ0DWJRGqGQL9TEvBFEhU5PUm1jYXjXzjJy5vHFj4EveZP39U FOtwIQMsyeHpPeW1KDicwMrpn6Dm/GKVK74HVPym9HJhTpL757K67BA+ dHMzySfMKt0qKyeUVkskZ0Tu6DJKjgB8De9ti6hHNrrh89r3lxg1b7r5 B/o= ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Tue Apr 12 07:13:18 2016 ;; MSG SIZE rcvd: 602
我需要改变什么才能得到完全authentication的响应，即AD位集？