1
vote
0answers
15 views

Managing multiple equal zones with DNSSEC

I run an authoritative name server (BIND), and I have a few dozens domain with identical zone files, i.e. they all use /etc/bind/db.default3. I’m considering deploying DNSSEC on my server, but so far ...
1
vote
1answer
68 views

How to DNSSEC Sign Bind9 Reverse Zone

I'm using bind9 and dnssec-keygen/dnssec-signzone. I've had no problem signing my forward zones however I cannot seem to find any documentation on signing reverse zones. What is the process for this?
1
vote
1answer
70 views

Effects of publishing DNSSEC DS records without signing public zone?

We at example.com are being pressured to implement DNSSEC by a sub-division of our organisation: security.example.com. Our current name servers ns1.example.com and ns2.example.com are unsigned, ...
2
votes
2answers
77 views

DNSSEC auto signing and file handling

I would like to know how files are handled in a auto-dnssec environment. My current setup (non-DNSSEC) places the zones files in /var/named/data. These files are then read by the bind server. If I ...
0
votes
1answer
180 views

BIND9 DNSSEC: should I care about occasional “insecure” log messages

A small number of my forwarded DNS queries cause BIND 9 to log messages such as: 184.in-addr.arpa SOA: got insecure response; parent indicates it should be secure validating @0x7f93140c0870: ...
0
votes
0answers
137 views

caching nameserver complains dumping master file: tmp-4H4fMHn0WI: open: permission denied

This is a Fedora 19 server acting as the name server (among other things) for a small network. Bind is working just fine as a caching name server for this small network. In case it matters, the ...
0
votes
1answer
259 views

Using DNSSEC with GoDaddy

This is my setup Domain: nginx-repo[.]com (Registered at GoDaddy) Nameserver: A DigitalOcean VM running BIND on Debian 7 I created a zone for the above mentioned domain on my VM then used ...
0
votes
1answer
39 views

DNSSEC key information for Bind 9

Is there a tool which allows me to view the parameters of an existing private/public key used for DNSSEC in Bind 9? I've been unable to determine simple things such as the expiration date, the ...
1
vote
1answer
176 views

Submit DS record to parent zone in DNS

I have setup DNSSEC for my domain shabdiznet.com and checked it at http://dnssec-debugger.verisignlabs.com/shabdiznet.com the only problem is No DS records found for shabdiznet.com in the com ...
0
votes
1answer
114 views

bind is not validating dnssec

Strange. My bind is not validating dnssec even though I configured it to. Version according to named -V is BIND 9.8.2rc1-RedHat-9.8.2-0.10.rc1.el6_3.2 which has a built-in DLV key. Under options in ...
0
votes
1answer
88 views

Should DNSSEC validation be done in the recursive DNS server or in client software?

As the title says. The design of DNSSEC and its implementation in Bind (and things like Unbound) quite clearly allow for either use. They can optionally do DNSSEC validation, returning SERVFAIL if ...
2
votes
0answers
199 views

How can I disable DNSSC for Google Apps (GMail) MX records on my authoritative domains?

I'm running a BIND Master / Slave setup with DNSSEC, but some of my domains use Google Apps for e-mail services. Google doesn't support DNSSEC and BIND doesn't like it at all. Log output: Sep 6 ...
5
votes
2answers
684 views

What are acceptable key lengths for DNSSEC KSK/ZSK?

I've been tasked to look into implementing DNSSEC on our name servers. While the technical side of this (generate keys, sign zones, prepare rollovers) are relatively straightforward, I've run into a ...
3
votes
1answer
1k views

Basic DNSSEC configuration under BIND 9.7?

Could anybody provide a step-by-step procedure to set up DNSSEC under BIND 9.7? I think the version is relevant because it is supposed to make life easier. In fact, there is a document published by ...
2
votes
1answer
274 views

Inline signing with bind 9.9 and NSEC3

Since version 9.9, Bind supports inline signing, but I don't find any information on how to make it working with NSEC3. I cannot add NSEC3PARAM RR with nsupdate : I think it's normal because of inline ...
3
votes
1answer
3k views

nsupdate, getting BADKEY error

I'm trying to update a name using nsupdate executed from within the name server itself but I receive the error message ; TSIG error with server: tsig indicates error. I created a key with ...
0
votes
1answer
77 views

How long it takes to start Bind?

I'm testing DNSSEC and I need to obtain the time in miliseconds it takes to start Bind now that I have signed zones. I don't know if this would be the right way to do it: time svcadm enable ...
1
vote
2answers
1k views

DNSSEC - Ad Flag not activated

I have some doubts regarding DNSSEC. I have one server acting as an Authoritative Name Server and another one as a Cache/Resolver. I'm using Bind 9.7.1-P2 and these are my configuration files: ...
3
votes
3answers
285 views

DNSSEC + Bind : dnskey invalidated by tld

I'm trying to enable DNSSEC on my authoritative dns Bind machine. So far I've done the following Tutorial : Generate the KSK and ZSK Keys : dnssec-keygen -a RSASHA1 -b 1024 -n ZONE zonename ...
0
votes
1answer
117 views

What strength should I use for my ISC BIND transfer key?

Currently I'm using 128, is this secure enough? dnssec-keygen -a hmac-md5 -b 128 -n host foobar.com Also I'm not sure if "host" is the correct value for -n arg. I believe that the last argument ...