On Sun, 22 Aug 2010, Mans Nilsson wrote:
OTOH: A thicker stub resolver does indeed exist; lwresd in the BIND suite. Calling it from applications does however mean using new API calls; since the traditional resolver API is oblivious to DNSSEC.
lwresd is in fact a full service resolver, though it is designed for forward-only usage. Although its man page says it is "stripped-down", it is in fact just the normal named binary running in a mode with a simple canned configuration that gets its forwarders from /etc/resolv.conf. AIUI, lwresd was originally conceived to deal with the original IPv6 DNS support (A6 records and binary labels). It would need quite a lot of re-working in the lwres client library (and possibly also the lwres protocol) to provide proper DNSSEC support. Tony. -- f.anthony.n.finch <dot@dotat.at> http://dotat.at/ GERMAN BIGHT: CYCLONIC, BECOMING SOUTHWEST, GALE 8 TO STORM 10, INCREASING VIOLENT STORM 11 FOR A TIME. ROUGH OR VERY ROUGH. RAIN OR SQUALLY SHOWERS. MODERATE OR POOR.