Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Trying to get DNSSEC working for zone.

Software: BIND 9.4.2-P2, OS Ubuntu 8.04

Tried to sign zone using ZoneSigner and publish that to, but it complains about key missing. Key shows when using dig dnskey . Domain is

Exact error message

3.138:DEBUG RUN GET_ADDRESSES: Sending a recursive query for A
3.532:DEBUG RUN GET_ADDRESSES: Got response for recursive query A NOERRO R
3.533:DEBUG RUN GET_ADDRESSES: Caching address for =>
3.725:DEBUG RUN: Enqueued query 7 to for DNSKEY
3.725:DEBUG RUN: Got activity for 2, from
3.725:DEBUG RUN: Got referral
3.726:DEBUG RUN: 1800 IN NS
3.727:DEBUG RUN: Already have queued
3.727:DEBUG RUN: Got activity for 3, from
3.727:DEBUG RUN: Got referral
3.728:DEBUG RUN: 1800 IN NS
3.729:DEBUG RUN: Already have queued
3.729:DEBUG RUN: Got activity for 4, from
3.729:DEBUG RUN: Got referral
3.730:DEBUG RUN: 1800 IN NS
3.730:DEBUG RUN: Already have queued
3.730:DEBUG RUN: Got activity for 5, from
3.730:DEBUG RUN: Got referral
3.731:DEBUG RUN: 1800 IN NS
3.732:DEBUG RUN: Already have queued
3.732:DEBUG RUN: Got activity for 6, from
3.732:DEBUG RUN: Got referral
3.733:DEBUG RUN: 1800 IN NS
3.733:DEBUG RUN: Already have queued
4.223:DEBUG RUN: Got activity for 7, from
4.223:DEBUG RUN: Found answer from
4.227:SUCCESS answered DNSKEY query with rcode NOERROR
4.227:INFO Total answers: 1
4.228:SUCCESS All DNSKEY responses are identical.
4.236:DEBUG VERIFY-DNSKEY: Checking tag=32656 flags=257 alg=RSASHA1 AwEAAcAo...Qbb+6aKYw8=
4.236:DEBUG VERIFY-DNSKEY: Accepted key.
4.237:DEBUG VERIFY-DNSKEY: Checking tag=58348 flags=257 alg=RSASHA1 AwEAAZbV...HzR2UTmRw0=
4.237:DEBUG VERIFY-DNSKEY: Ignoring key.
4.237:DEBUG VERIFY-DNSKEY: Checking tag=41748 flags=256 alg=RSASHA1 AwEAAeJC...u4rnFt63+RV
4.238:DEBUG VERIFY-DNSKEY: Ignoring key.
4.238:DEBUG VERIFY-DNSKEY: Checking tag=64185 flags=256 alg=RSASHA1 AwEAAZ/S...x8pRgin/Vq5
4.238:DEBUG VERIFY-DNSKEY: Ignoring key.
4.238:DEBUG VERIFY-DNSKEY: Checking tag=21258 flags=256 alg=RSASHA1 AwEAAdlD...3Nv3HgYux4D
4.238:DEBUG VERIFY-DNSKEY: Ignoring key.
4.239:INFO VERIFY-DNSKEY: 1 keys found after filtering.
4.239:DEBUG VERIFY-DNSKEY: Using keys:
4.239:DEBUG VERIFY-DNSKEY: tag=32656 flags=257 alg=RSASHA1 AwEAAcAo...Qbb+6aKYw8=
4.239:DEBUG VERIFY-DNSKEY: To verify rrset type DNSKEY
4.242:FAILURE DNSKEY signature verification failed: Signing key not found
share|improve this question
please quote the exact error message from the DLV website – Alnitak Nov 8 '09 at 3:05
published exact erro message – Kristaps Nov 8 '09 at 13:02
up vote 4 down vote accepted

It looks like you've tried to add a KSK with id=32656 to DLV, but you only signed the zone with KSK 58348.

You need to either add the correct key to DLV (id=58348) or use id=32656 to sign the DNSKEY RRSET.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.