As I understand it, the default dnsmasq settings on the Flint 2 clear the ad flag if requesting dnssec. So I’m wondering why, and if it is an easy task to allow the ad flag to be passed on. So, for example on a basic dig command: dig @9.9.9.9 dnssec.works +dnssec no ad flag is returned, which, as I understand it, is due to the Flint’s dnsmasq clearing this flag if it is set. Even if trying to “force” it by adding +adflag to dig command.
So question’s:
- how to allow for the ad flag to be passed on?
- Is it an “easy” task?
- Is it worth it?
Any / all help/comments appreciated. It’s a learning process for me
1 Like
Hi
Please refer to the dnsmasq documentation below. If you need dnsmasq to propagate the AD (Authenticated Data) flag, you will need to enable the following option:
On the MT6000, you can enable it with the following commands:
uci set dhcp.@dnsmasq[0].proxydnssec='1'
uci commit dhcp
/etc/init.d/dnsmasq restart
To verify that the setting has been successfully applied to the generated configuration file, run:
grep proxy-dnssec /var/etc/dnsmasq.conf.*
Then you should be able to see AD flags:
Perfect, thank you. Now I need to decide if I really, honestly need this 
Again, thank you for the detailed and concise reply!!!
