Since version 9.9, Bind supports inline signing, but I don't find any information on how to make it working with NSEC3. I cannot add NSEC3PARAM RR with nsupdate : I think it's normal because of inline signing, but I cannot parameter this for inline signing.

Has someone setup and tested it, or an idea ?

Thanks for answers.

1 Answer 1


Finally I found the answer on bind-user mailing list.

Instead of using nsupdate, I should use the next command :

rndc signing -nsec3param 1 1 100 $(head -c 512 /dev/random | sha1sum | cut -b 1-16) <zonename>

Hope this question will help someone in the future.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.