We at example.com are being pressured to implement DNSSEC by a sub-division of our organisation: security.example.com.

Our current name servers ns1.example.com and ns2.example.com are unsigned, non-dnssec servers.

We would like to use ns1.example.com as a hidden master and implement inline signing in bind as per: Example #2 . Our new DNSSEC enabled servers for example.com will be dns1.example.com and dns2.example.com.

We would like to publish the DS records to the .com registrar so that we can internally test the new DNSSEC servers. The SOA would remain ns1.example.com (And the NS records would not include the DNSSEC servers for the time being).

My question is:

If we publish DS records to .com for our DNSSEC servers, will dnssec-validating DNS servers break when they realize there is no DNSSEC functionality at ns1.example.com or ns2.example.com?


Are there any other side effects we should be on the lookout for with this hybrid setup?


If you publish DS records in the tld zone and your public nameservers do not support DNSSEC then your records will fail validation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.