example.com are being pressured to implement DNSSEC by a sub-division of our organisation:
Our current name servers
ns2.example.com are unsigned, non-dnssec servers.
We would like to use
ns1.example.com as a hidden master and implement inline signing in bind as per: Example #2 . Our new DNSSEC enabled servers for
example.com will be
We would like to publish the
DS records to the
.com registrar so that we can internally test the new DNSSEC servers. The
SOA would remain
ns1.example.com (And the
NS records would not include the DNSSEC servers for the time being).
My question is:
If we publish
DS records to
.com for our DNSSEC servers, will dnssec-validating DNS servers break when they realize there is no DNSSEC functionality at
Are there any other side effects we should be on the lookout for with this hybrid setup?