<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Bert,<br class=""><div><br class=""></div><div>bert hubert <<a href="mailto:bert.hubert@powerdns.com" class="">bert.hubert@powerdns.com</a>> wrote:</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class="">Resolvers rarely if ever send out AA=1 answers. If you literally want to<br class="">forward packets, dnsdist may be a better choice. <br class=""><br class="">Is the current behaviour causing you problems? If so can you tell us about<br class="">those problems?<br class=""></div></div></blockquote></div><br class=""><div class="">I can probably use dnsdist (I only just learned about it today), but given the description of the recursor's <font face="Courier New" class="">forward-zones</font> option I assumed it was meant to "delegate" certain zones to authoritative servers, and I would've expected it to pass through the AA=1 bits coming back from such an authoritative server.</div><div class=""><br class=""></div><div class="">To explain what I'm trying to do: I want to serve a zone of dynamic <font face="Courier New" class="">A</font> records referenced from SPF records with "<font face="Courier New" class="">exists:%{i}</font>" mechanisms from a little custom DNS server, but I want to front this server with something that I trust to implement the DNS protocol robustly and securely. So I'll give dnsdist a try next.</div><div class=""><br class=""></div><div class="">Thanks!</div><div class=""><br class=""></div><div class="">-Julian</div><div class=""><br class=""></div></body></html>