I'm trying to enable DNSSEC on my authoritative dns Bind machine. So far I've done the following Tutorial :
Generate the KSK and ZSK Keys :
dnssec-keygen -a RSASHA1 -b 1024 -n ZONE zonename
dnssec-keygen -a RSASHA1 -b 4096 -n ZONE -f KSK zonename
Include the pub key in the zone and sign the zone :
dnssec-signzone -o zonename -k KSKfile zonefile ZSKfile
Add the signed zone in place of the old one in named.conf
- Restart Bind
I don't know if I've missed something but the registrar that support DNSSEC keep telling me :
Error Signature DNSKEY entries is not valid. Error Signature SOA entry is not valid.
Does anyone know how to solve this ? Is there any online DNSSEC tool that display more infos about the dnssec status ?