[dns-operations] Trouble with qa.ws.igt.fiscal.treasury.gov

[Viktor Dukhovni]

On Wed, Oct 19, 2022 at 06:58:21AM +1100, Mark Andrews wrote:

> Not for DS  as it is part of the parent zone. 

But is not an "apex" DS query, the parent zone (if "igt" were delegated)
would surely be fiscal.treasury.gov.

> > $ dig +dnssec @ns1.treasury.gov igt.fiscal.treasury.gov ds | awk '$4 == "RRSIG" { print $12 }'
> > treasury.gov.
> > treasury.gov.
> > 
> > Because there is a zone cut at fiscal.treasury.gov, the the signer
> > should be fiscal.treasury.gov.  That being said, I can't tell
> > at-a-glance why DNSViz is drawing ZSK 3908 in the
> > fiscal.treasury.gov zone, rather than in the treasury.gov zone.

-- 
    Viktor.