I run an authoritative name server (BIND), and I have a few dozens domain with identical zone files, i.e. they all use
I’m considering deploying DNSSEC on my server, but so far all documentation I found on it would require me to do many manual steps per zone (such as generating KSK and ZSK). BIND 9.9’s inline-signing makes some of it easier, but not everything.
So, can I make BIND, in inline-signing mode, use the same KSK for multiple domains? If so, will I be able to put the same value in the
DS record for these domains? And why do I have to manage the ZSK – shouldn’t BIND, given a KSK, be able to take care of that for me?