Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We at example.com are being pressured to implement DNSSEC by a sub-division of our organisation: security.example.com.

Our current name servers ns1.example.com and ns2.example.com are unsigned, non-dnssec servers.

We would like to use ns1.example.com as a hidden master and implement inline signing in bind as per: Example #2 . Our new DNSSEC enabled servers for example.com will be dns1.example.com and dns2.example.com.

We would like to publish the DS records to the .com registrar so that we can internally test the new DNSSEC servers. The SOA would remain ns1.example.com (And the NS records would not include the DNSSEC servers for the time being).

My question is:

If we publish DS records to .com for our DNSSEC servers, will dnssec-validating DNS servers break when they realize there is no DNSSEC functionality at ns1.example.com or ns2.example.com?

AND

Are there any other side effects we should be on the lookout for with this hybrid setup?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

If you publish DS records in the tld zone and your public nameservers do not support DNSSEC then your records will fail validation.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.