[gmarzot@alvin validator]$ apps/validate -o7:stderr -p good-A.good-ns.test.dnssec-tools.org
Reading resolver policy from /etc/resolv.conf
Reading validator policy from /etc/dnsval.conf
Reading next policy fragment
Result: ****START****
val_resolve_and_check(): looking for {good-A.good-ns.test.dnssec-tools.org 1 1}
ask_cache(): looking for {good-A.good-ns.test.dnssec-tools.org IN(1) A(1)}
ask_resolver(): sending query for {good-A.good-ns.test.dnssec-tools.org 1 1}
good-A.good-ns.test.dnssec-tools.org requires DNSSEC
Setting D0 bit and using EDNS0
Sending query for good-A.good-ns.test.dnssec-tools.org to:
    192.168.1.1
End of Sending query for good-A.good-ns.test.dnssec-tools.org
good-A.good-ns.test.dnssec-tools.org requires DNSSEC
ask_resolver(): found data for {good-A.good-ns.test.dnssec-tools.org 1 1}
good-A.good-ns.test.dnssec-tools.org requires DNSSEC
ask_cache(): looking for {good-A.good-ns.test.dnssec-tools.org IN(1) RRSIG(46)}
ask_resolver(): sending query for {good-A.good-ns.test.dnssec-tools.org 1 46}
good-A.good-ns.test.dnssec-tools.org requires DNSSEC
Setting D0 bit and using EDNS0
Sending query for good-A.good-ns.test.dnssec-tools.org to:
    192.168.1.1
End of Sending query for good-A.good-ns.test.dnssec-tools.org
Finding next zone cut
val_resolve_and_check(): looking for {good-A.good-ns.test.dnssec-tools.org 1 6}
ask_cache(): looking for {good-A.good-ns.test.dnssec-tools.org IN(1) SOA(6)}
ask_resolver(): sending query for {good-A.good-ns.test.dnssec-tools.org 1 6}
Not setting D0 bit nor using EDNS0
Sending query for good-A.good-ns.test.dnssec-tools.org to:
    192.168.1.1
End of Sending query for good-A.good-ns.test.dnssec-tools.org
good-A.good-ns.test.dnssec-tools.org requires DNSSEC
ask_resolver(): found data for {good-A.good-ns.test.dnssec-tools.org 1 6}
Bogus Proof
About to check if good-ns.test.dnssec-tools.org is provably unsecure.
val_resolve_and_check(): looking for {good-ns.test.dnssec-tools.org 1 43}
ask_cache(): looking for {good-ns.test.dnssec-tools.org IN(1) DS(43)}
ask_resolver(): sending query for {good-ns.test.dnssec-tools.org 1 43}
good-ns.test.dnssec-tools.org requires DNSSEC
Setting D0 bit and using EDNS0
Sending query for good-ns.test.dnssec-tools.org to:
    192.168.1.1
End of Sending query for good-ns.test.dnssec-tools.org
good-ns.test.dnssec-tools.org requires DNSSEC
ask_resolver(): found data for {good-ns.test.dnssec-tools.org 1 43}
good-ns.test.dnssec-tools.org requires DNSSEC
ask_cache(): looking for {good-ns.test.dnssec-tools.org IN(1) RRSIG(46)}
ask_resolver(): sending query for {good-ns.test.dnssec-tools.org 1 46}
good-ns.test.dnssec-tools.org requires DNSSEC
Setting D0 bit and using EDNS0
Sending query for good-ns.test.dnssec-tools.org to:
    192.168.1.1
End of Sending query for good-ns.test.dnssec-tools.org
Finding next zone cut
val_resolve_and_check(): looking for {test.dnssec-tools.org 1 6}
ask_cache(): looking for {test.dnssec-tools.org IN(1) SOA(6)}
ask_resolver(): sending query for {test.dnssec-tools.org 1 6}
Not setting D0 bit nor using EDNS0
Sending query for test.dnssec-tools.org to:
    192.168.1.1
End of Sending query for test.dnssec-tools.org
test.dnssec-tools.org requires DNSSEC
ask_resolver(): found data for {test.dnssec-tools.org 1 6}
About to check if test.dnssec-tools.org is provably unsecure.
val_resolve_and_check(): looking for {test.dnssec-tools.org 1 43}
ask_cache(): looking for {test.dnssec-tools.org IN(1) DS(43)}
ask_resolver(): sending query for {test.dnssec-tools.org 1 43}
test.dnssec-tools.org requires DNSSEC
Setting D0 bit and using EDNS0
Sending query for test.dnssec-tools.org to:
    192.168.1.1
End of Sending query for test.dnssec-tools.org
test.dnssec-tools.org requires DNSSEC
ask_resolver(): found data for {test.dnssec-tools.org 1 43}
test.dnssec-tools.org requires DNSSEC
ask_cache(): looking for {test.dnssec-tools.org IN(1) RRSIG(46)}
ask_resolver(): sending query for {test.dnssec-tools.org 1 46}
test.dnssec-tools.org requires DNSSEC
Setting D0 bit and using EDNS0
Sending query for test.dnssec-tools.org to:
    192.168.1.1
End of Sending query for test.dnssec-tools.org
Zone test.dnssec-tools.org is not provably unsecure.
Zone good-A.good-ns.test.dnssec-tools.org is not provably unsecure.
Result:         FAILED: Some results were not validated successfully
Original query: name=good-A.good-ns.test.dnssec-tools.org class=IN type=A from-server=192.168.1.1, Query-status=Q_ANSWERED:4
  Result: VAL_ERROR:30
    name=good-A.good-ns.test.dnssec-tools.org class=IN type=A from-server=192.168.1.1 status=VAL_AC_RRSIG_MISSING:15
    name=good-ns.test.dnssec-tools.org class=IN type=DS from-server=192.168.1.1 status=VAL_AC_RRSIG_MISSING:15
Result: ****END****

DNSSEC status: VAL_ERROR [30]
Untrusted response:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 0
;; flags:; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;;      good-A.good-ns.test.dnssec-tools.org, type = A, class = IN
good-A.good-ns.test.dnssec-tools.org.  1D IN A  168.150.236.43