我正在这Deterlab 练习，我在将 DNSSEC 添加到 Bind 时遇到了一些问题。服务器运行 BIND 9.7.0-P1。我所做的配置如下：google.com 的签名区域：
zonesigner -genkeys google.com
在文件下为 google.com 添加了 .signed 到 named.conf.local。
添加到named.conf.options：
dnssec-enabled yes;
dnssec-validation yes;
添加到named.conf：
include "/etc/bind/bind.keys";
使用bind.keys：
trusted-keys {
. 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF
FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX
bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD
X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz
W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS
Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq
QxA+Uk1ihz0=";
};
所有文件都可以通过 named-checkconf 顺利编译。当我重新启动 bind 并运行 dig 时，我仍然没有得到 AD 位：
sudo dig +dnssec www.google.com A
; <<>> DiG 9.7.0-P1 <<>> +dnssec www.google.com A
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20641
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 3
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;www.google.com. IN A
;; ANSWER SECTION:
www.google.com. 10 IN A 10.1.2.155
www.google.com. 10 IN RRSIG A 5 3 10 20160512120048 20160412120048 34206 google.com. QPVwvcsE5VXvMxnhS8/7LDwBWoTopQAuFPaRBeOSlARwTJkuReNgmqoL GcDD++zgS536YlrLGqAr+06fl2fnnnxtfwZUu6pwVmeosnmsU8b3Jd+b domXH138Ob1cBuS7Z5KDI94LkBfTu0ksFEBfcs7lCtvyY9zMw7BWhQ2L lnU=
;; AUTHORITY SECTION:
google.com. 604800 IN NS ns.google.com.
google.com. 604800 IN RRSIG NS 5 2 604800 20160512120048 20160412120048 34206 google.com. qnx8xI4qYfGBZ3GygxdCrgdoA7x8YwlYYVWPOntQax6Jzhof0V8FgQR6 FqXVVyOeA9aapVimYh45tI42WJ2DyNc8GgCX3xKwPdlmf3zrQqRKcr9F L/6tlLu+ZjBxPbQamLXueXM6m9eFSp9OMqj4EqDCCCA3fzXCkakQyv6P uIw=
;; ADDITIONAL SECTION:
ns.google.com. 10 IN A 10.1.2.3
ns.google.com. 10 IN RRSIG A 5 3 10 20160512120048 20160412120048 34206 google.com. ajOz8/kjZ0DWJRGqGQL9TEvBFEhU5PUm1jYXjXzjJy5vHFj4EveZP39U FOtwIQMsyeHpPeW1KDicwMrpn6Dm/GKVK74HVPym9HJhTpL757K67BA+ dHMzySfMKt0qKyeUVkskZ0Tu6DJKjgB8De9ti6hHNrrh89r3lxg1b7r5 B/o=
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Apr 12 07:13:18 2016
;; MSG SIZE rcvd: 602
为了获得完全验证的响应，我需要进行什么更改，即 AD 位设置？