DNSSEC ValidateChain is not called from production code

[poyrazK]

Problem

The DNSSECValidator.ValidateChain() function (issue #92 fix) validates the full DNSSEC trust chain from leaf zone to trust anchor. However, this function is never called from production code - only from tests.

Current Usage

Production code (server.go:validateDNSSEC) only calls ValidateRRSet() to validate individual RRsets, not ValidateChain().

Root Cause

To call ValidateChain, you would need to:

1. Build a chain by walking from leaf zone up to root
2. For each zone link, collect: DNSKEYs, DS records from parent, AND RRSIG_DS records
3. Make network fetches for DNSKEYs at each level

This chain-building logic was never implemented in the DNSSEC MVP.

Implication

Issue #92 fix is correct and useful, but ValidateChain won't be exercised until chain validation is wired up in production. The fix ensures:

1. The validator logic is correct when eventually used
2. Tests properly verify the RRSIG_DS verification behavior

Potential Solution Options

1. Wire up chain validation - Implement the chain-building logic in validateDNSSEC or a new method to walk the trust chain
2. Document as incomplete - Mark the ADR 0008 limitation tracking this as future work
3. Both - Wire it up and update documentation

References

• ADR 0008: DNSSEC Validation (describes MVP limitations)
• Issue DNSSEC ValidateChain never verifies any signatures #92: DNSSEC ValidateChain never verifies any signatures (now fixed)