Also check NS record for validity

[tools.git] / dnssec-check

diff --git a/dnssec-check b/dnssec-check
index e88fc5da1b648a97430825f50e1c6ca0536e7923..162d77c01d5cdcf25232d289a9c5409868445269 100755 (executable)
--- a/dnssec-check
+++ b/dnssec-check
@@ -51,6 +51,10 @@ def check_zone_synced(resolver, name):
         ub_strerror(s)
         return 3
 
+    if not result.secure:
+        print("CRIT (does not verify) %s" % (name, ))
+        return 2
+
     nameservers = result.data.as_domain_list()
     nsips = []
     for nameserver in nameservers: