"=> going insecure because there's no covering TA" message
Deckard often prints this at the beginning of the log, even on tests where data are DNSSEC-validated correctly.
Maybe this is a problem in kresd logging or something like that.
for example: log:
deckard.py 364 DEBUG [36622.00][iter] 'b.example.com.' type 'DS' new uid was assigned .01, parent uid .00
deckard.py 364 DEBUG [36622.01][resl] => going insecure because there's no covering TA
deckard.py 364 DEBUG [36622.01][resl] => using root hints
deckard.py 364 DEBUG [36622.01][iter] 'b.example.com.' type 'DS' new uid was assigned .02, parent uid .00
deckard.py 364 DEBUG [36622.02][resl] => id: '50568' querying: '193.0.14.129' score: 10 zone cut: '.' qname: 'b.EXampLe.COm.' qtype: 'DS' proto: 'udp'
deckard.py 364 DEBUG [36622.02][iter] <= answer received:
deckard.py 364 DEBUG ;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 50568
deckard.py 364 DEBUG ;; Flags: qr QUERY: 1; ANSWER: 0; AUTHORITY: 1; ADDITIONAL: 2
deckard.py 364 DEBUG
deckard.py 364 DEBUG ;; EDNS PSEUDOSECTION:
deckard.py 364 DEBUG ;; Version: 0; flags: ; UDP size: 1280 B; ext-rcode: Unused
deckard.py 364 DEBUG
deckard.py 364 DEBUG ;; QUESTION SECTION
deckard.py 364 DEBUG b.example.com. DS
deckard.py 364 DEBUG
deckard.py 364 DEBUG ;; AUTHORITY SECTION
deckard.py 364 DEBUG com. 3600 NS a.gtld-servers.net.
deckard.py 364 DEBUG
deckard.py 364 DEBUG [36622.02][iter] <= loaded 1 glue addresses
deckard.py 364 DEBUG [36622.02][iter] <= referral response, follow
deckard.py 364 DEBUG [36622.02][cach] => stashed com. NS, rank 002, 36 B total, incl. 0 RRSIGs
deckard.py 364 DEBUG [36622.02][cach] => stashed also 1 nonauth RRsets
deckard.py 364 DEBUG [36622.02][resl] <= server: '193.0.14.129' rtt: 103 ms
deckard.py 364 DEBUG [36622.02][iter] 'b.example.com.' type 'DS' new uid was assigned .03, parent uid .00
deckard.py 364 DEBUG [36622.03][resl] => id: '52885' querying: '192.5.6.30' score: 10 zone cut: 'com.' qname: 'b.EXampLe.CoM.' qtype: 'DS' proto: 'udp'
deckard.py 364 DEBUG [36622.03][iter] <= answer received:
deckard.py 364 DEBUG ;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 52885
deckard.py 364 DEBUG ;; Flags: qr QUERY: 1; ANSWER: 0; AUTHORITY: 1; ADDITIONAL: 2
deckard.py 364 DEBUG
deckard.py 364 DEBUG ;; EDNS PSEUDOSECTION:
deckard.py 364 DEBUG ;; Version: 0; flags: ; UDP size: 1280 B; ext-rcode: Unused
deckard.py 364 DEBUG
deckard.py 364 DEBUG ;; QUESTION SECTION
deckard.py 364 DEBUG b.example.com. DS
deckard.py 364 DEBUG
deckard.py 364 DEBUG ;; AUTHORITY SECTION
deckard.py 364 DEBUG example.com. 3600 NS ns.example.com.
deckard.py 364 DEBUG
deckard.py 364 DEBUG [36622.03][iter] <= loaded 1 glue addresses
deckard.py 364 DEBUG [36622.03][iter] <= referral response, follow
deckard.py 364 DEBUG [36622.03][cach] => stashed example.com. NS, rank 002, 32 B total, incl. 0 RRSIGs
deckard.py 364 DEBUG [36622.03][cach] => stashed also 1 nonauth RRsets
deckard.py 364 DEBUG [36622.03][resl] <= server: '192.5.6.30' rtt: 5 ms
deckard.py 364 DEBUG [36622.03][iter] 'b.example.com.' type 'DS' new uid was assigned .04, parent uid .00
deckard.py 364 DEBUG [36622.04][resl] >< TA: 'example.com.'
deckard.py 364 DEBUG [36622.04][plan] plan 'example.com.' type 'DNSKEY' uid [36622.05]
deckard.py 364 DEBUG [36622.05][iter] 'example.com.' type 'DNSKEY' new uid was assigned .06, parent uid .04
deckard.py 364 DEBUG [36622.06][cach] => no NSEC* cached for zone: example.com.
deckard.py 364 DEBUG [36622.06][cach] => skipping zone: example.com., NSEC, hash 0;new TTL -123456789, ret -2
deckard.py 364 DEBUG [36622.06][cach] => skipping zone: example.com., NSEC, hash 0;new TTL -123456789, ret -2
deckard.py 364 DEBUG [36622.06][resl] => id: '19571' querying: '1.2.3.4' score: 10 zone cut: 'example.com.' qname: 'EXaMPlE.Com.' qtype: 'DNSKEY' proto: 'udp'
deckard.py 364 DEBUG [36622.06][iter] <= answer received:
deckard.py 364 DEBUG ;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 19571
deckard.py 364 DEBUG ;; Flags: qr QUERY: 1; ANSWER: 2; AUTHORITY: 2; ADDITIONAL: 3
deckard.py 364 DEBUG
deckard.py 364 DEBUG ;; EDNS PSEUDOSECTION:
deckard.py 364 DEBUG ;; Version: 0; flags: do; UDP size: 1280 B; ext-rcode: Unused
deckard.py 364 DEBUG
deckard.py 364 DEBUG ;; QUESTION SECTION
deckard.py 364 DEBUG example.com. DNSKEY
deckard.py 364 DEBUG
deckard.py 364 DEBUG ;; ANSWER SECTION
deckard.py 364 DEBUG example.com. 3600 DNSKEY 256 3 7 AwEAAef0Gt81KzrbFGbFmk6VeEzLLcRbnKiDjdMBO7R+HsQWCO9YpPGx20mBEV7ISCLva+LZulf584i30ga7qMeVsarsdh9xCYtyMXd4Ex5nMEXxV9f2Or+FjihPduL2TnAlWpvL8oc1oKVI2RISTT1yf8IYy6X/FpfmMP819WBN2Kit
deckard.py 364 DEBUG example.com. 3600 RRSIG DNSKEY 7 2 3600 20181230101851 20181130101851 16907 example.com. RPXAcaVjBdtk/geHTdTg9ZOKREpAdjZAopRE/5Kk9fdFYQWwg0uRxexLPJ11jXjnp9MKOp1FehctyvE/mm1lB/J6+YepHu3tRAzzJ9YfjVxJjUppQv/nA/fU55MHWYhdhXwKn7F+PXD8+MFlAqPyFz9mYZEO89lI4P2/Wf4xpv4=
deckard.py 364 DEBUG
deckard.py 364 DEBUG ;; AUTHORITY SECTION
deckard.py 364 DEBUG example.com. 3600 NS ns.example.com.
deckard.py 364 DEBUG example.com. 3600 RRSIG NS 7 2 3600 20181230101851 20181130101851 16907 example.com. KXsKhCme80OQl4qekE+q0KvymkhEelk+OdOsajCsGmfG5eeCEkN58gVw5fBgtR2Ekp15KLsV1elsyVL8i7W5Hp5f2G70/plqSQ+78n3Al5jXONgNoVFSOuf8N179F2uf3k20MpnlxQQ7W/VX6SpuAOejyVpp6il6dm2YwRHHnX4=
deckard.py 364 DEBUG
deckard.py 364 DEBUG [36622.06][iter] <= loaded 1 glue addresses
deckard.py 364 DEBUG [36622.06][iter] <= rcode: NOERROR
deckard.py 364 DEBUG [36622.06][vldr] <= parent: updating DNSKEY
deckard.py 364 DEBUG [36622.06][vldr] <= answer valid, OK
deckard.py 364 DEBUG [36622.06][cach] => stashed example.com. DNSKEY, rank 060, 314 B total, incl. 1 RRSIGs
deckard.py 364 DEBUG [36622.06][cach] => not overwriting A ns.example.com.
deckard.py 364 DEBUG [36622.06][resl] <= server: '1.2.3.4' rtt: 7 ms
deckard.py 364 DEBUG [36622.04][iter] 'b.example.com.' type 'DS' new uid was assigned .07, parent uid .00
deckard.py 364 DEBUG [36622.07][resl] => id: '04066' querying: '1.2.3.4' score: 11 zone cut: 'example.com.' qname: 'b.EXAmPLE.cOM.' qtype: 'DS' proto: 'udp'
deckard.py 364 DEBUG [36622.07][iter] <= answer received:
deckard.py 364 DEBUG ;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 4066
deckard.py 364 DEBUG ;; Flags: qr aa QUERY: 1; ANSWER: 0; AUTHORITY: 4; ADDITIONAL: 1
deckard.py 364 DEBUG
deckard.py 364 DEBUG ;; EDNS PSEUDOSECTION:
deckard.py 364 DEBUG ;; Version: 0; flags: do; UDP size: 1280 B; ext-rcode: Unused
deckard.py 364 DEBUG
deckard.py 364 DEBUG ;; QUESTION SECTION
deckard.py 364 DEBUG b.example.com. DS
deckard.py 364 DEBUG
deckard.py 364 DEBUG ;; AUTHORITY SECTION
deckard.py 364 DEBUG example.com. 86394 SOA ns.iana.org. nstld.iana.org. 2007092000 1800 900 604800 86400
deckard.py 364 DEBUG example.com. 86394 RRSIG SOA 7 2 86394 20181230101851 20181130101851 16907 example.com. uQjgfvlcxQLPfqetqWjTgKTbDOK3BoqbdmrqudrEl/X/S3OR8uhTQu7PEsrJm7IP7lmKcsbF4LAFjBNRp28G4at8v5cnCpvZfKFDzO3JzCubaVnn18rSZj9gM1e4CN5ms/aAlr5I2hDhIQnsKmhxQBTrngyTcpGgf/YQuruMRKw=
deckard.py 364 DEBUG *.example.com. 3600 NSEC *.b.example.com. A MX RRSIG NSEC
deckard.py 364 DEBUG *.example.com. 86400 RRSIG NSEC 7 2 86400 20181230101851 20181130101851 16907 example.com. 5NyjMTv7p0jvYrfxQzTJXvTlf1Uy2tMSmYKEWZoBq87u6mLNBtRgpKl91gpVvT8o+uA2XAznujnFZYgLdE9Swk87KqQQSWkyM81458SuSVwB5hma9afCrB38FH9D9aOCN1nfqIuoEsQi3Bu3Uvtr+eV7oE97ViROSy/1pyyKg9A=
deckard.py 364 DEBUG
deckard.py 364 DEBUG [36622.07][iter] <= rcode: NOERROR
deckard.py 364 DEBUG [36622.07][vldr] <= DS doesn't exist, going insecure
deckard.py 364 DEBUG [36622.07][vldr] <= answer valid, OK
deckard.py 364 DEBUG [36622.07][cach] => stashed *.example.com. NSEC, rank 060, 204 B total, incl. 1 RRSIGs
deckard.py 364 DEBUG [36622.07][cach] => stashed example.com. SOA, rank 060, 228 B total, incl. 1 RRSIGs
deckard.py 364 DEBUG [36622.07][cach] => nsec_p stashed for example.com. (new, hash: 0)
deckard.py 364 DEBUG [36622.07][resl] <= server: '1.2.3.4' rtt: 7 ms
deckard.py 364 DEBUG [36622.07][resl] AD: request classified as SECURE
deckard.py 364 DEBUG [36622.07][resl] finished: 4, queries: 2, mempool: 16400 B
scenario.py 536 INFO [ RANGE 0-100 ] {'192.5.6.30'} received: 1 sent: 1
scenario.py 536 INFO [ RANGE 0-100 ] {'193.0.14.129'} received: 1 sent: 1
scenario.py 536 INFO [ RANGE 0-100 ] {'1.2.3.4'} received: 2 sent: 2
. [100%]
1 passed, 1 skipped in 1.32 seconds```
from test [val_mal_wc.rpl](https://gitlab.labs.nic.cz/knot/deckard/blob/master/sets/resolver/val_mal_wc.rpl)