以编程方式检查域是否受DNSSEC保护

Question

如标题所述，我想以编程方式检查域的DNS响应是否受DNSSEC保护。
我该怎么办？

如果有Pythonic解决方案，那就太好了。

更新：更改了响应请求，对于您的困惑感到抱歉

Answer 1

使用DNS解析器（例如dnspython），您可以查询域的DNSKEY RRset并打开DO（dnssec
OK）查询标志。如果查询成功，则答案将设置AD（已认证数据）标志，并将包含区域的RRSIG签名（如果已签名）。

更新：使用的基本示例 dnspython

import dns.name
import dns.query
import dns.dnssec
import dns.message
import dns.resolver
import dns.rdatatype

# get nameservers for target domain
response = dns.resolver.query('example.com.',dns.rdatatype.NS)

# we'll use the first nameserver in this example
nsname = response.rrset[0].to_text() # name
response = dns.resolver.query(nsname,dns.rdatatype.A)
nsaddr = response.rrset[0].to_text() # IPv4

# get DNSKEY for zone
request = dns.message.make_query('example.com.',
                                 dns.rdatatype.DNSKEY,
                                 want_dnssec=True)

# send the query
response = dns.query.udp(request,nsaddr)
if response.rcode() != 0:
    # HANDLE QUERY FAILED (SERVER ERROR OR NO DNSKEY RECORD)

# answer should contain two RRSET: DNSKEY and RRSIG(DNSKEY)
answer = response.answer
if len(answer) != 2:
    # SOMETHING WENT WRONG

# the DNSKEY should be self signed, validate it
name = dns.name.from_text('example.com.')
try:
    dns.dnssec.validate(answer[0],answer[1],{name:answer[0]})
except dns.dnssec.ValidationFailure:
    # BE SUSPICIOUS
else:
    # WE'RE GOOD, THERE'S A VALID DNSSEC SELF-SIGNED KEY FOR example.com