I've found the following guide on how to setup DNSSEC with NSD DNS server and ldns utilities: https://www.digitalocean.com/community/tutorials/how-to-set-up-dnssec-on-an-nsd-nameserver-on-ubuntu-14-04

Basically it provides the following steps:

  1. Generate ZSK and KSK using ldns-keygen
  2. Sign the zone using ldns-signzone with above keys
  3. Point NSD to the signed version of zone file and reload config
  4. Write DS entries for the domain of subject on registrar panel
  5. Use provided script (dnszonesigner) whenever you change your zone (unsigned file)

And this all works fine. However there is a comment "Have you thought about how to keep the signed zone fresh? RRSIG's will expire and should be refreshed in time. In other words, a signed zone should be resigned every once in a while."

Is it a correct remark? I can't find information about DNSSEC zones staling anywhere. If it correct, should I just run dnszonesigner script via cron, if so, how frequently should I? What will happen (and when) if I don't do this? Will DNSSEC aware resolvers, like Google Public DNS still provide correct answers for the records in my zone?


According to the listed below, even if you're data stay's the same, you should resign ones a month.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.