2022 Developer Survey is open! Take survey.

Questions tagged [dnssec]

Domain Name System Security Extension is a specification for securing certain kinds of information provided by Domain Name System

Filter by
Sorted by
Tagged with
2 votes
1 answer
125 views

Remove RRSIG record from GoDaddy subdomain

I added 4 NS entries for a subdomain for a SalesForce email campaign. SalesForce has since complained they see an "RRSIG entry for the subdomain" and they "do not support (add to NS) ...
user avatar
  • 143
0 votes
0 answers
12 views

DS requests sent to Cloudflare for internal TLD

I created a Bind9 configuration to provide DNS entries for an internal TLD. Bind9 uses Cloudflare as forwarder: options { directory "/var/cache/bind"; dnssec-validation auto; ...
user avatar
  • 239
0 votes
0 answers
8 views

Hardware requirments for tld registrar. Non icann dnssec and dane supported [duplicate]

I am trying to figure out requirments for a tld registrar. I have the names. Customers have the access. Just missing the skillset and hardware. Icann is not accepting these names at the moment,however ...
user avatar
0 votes
0 answers
38 views

Is it possible to have different internal and public DNS with DNSSEC?

I'm attempting to achieve the following: A public nameserver for my domain which points example.com to a public IP address. A private nameserver for the same domain running within a LAN which instead ...
user avatar
  • 461
0 votes
2 answers
75 views

Configuring BIND9 (ver 9.16) to allow TXT DNS updates from Letsncrypt

Solution to the below problem: Use $ddns-confgen or $tsig-keygen, the former provides you with the syntax to paste into your named.conf file Problem: I am trying to configure a BIND9 (ver9.161-Ubuntu) ...
user avatar
  • 1
0 votes
2 answers
104 views

How Do I Fix My DNSSEC? I never got DNSSEC working and have probably worsened the problems

My attempt to DNSSEC has not been successful. To help understand DNSSEC I have read many online articles, man pages for rndc, dnssec-*, viewed dnsviz.net and dnssec-analyzer.verisignlabs.com/. Most of ...
user avatar
  • 1
0 votes
1 answer
112 views

BIND 9.16 dnssec-policy default is not automatically renewing keys

Three months ago I upgraded my DNS servers to BIND 9.16 (currently running 9.16.25) to take advantage of the new dnssec-policy default option which would allow me to easily run DNSSEC for my domains. ...
user avatar
0 votes
1 answer
29 views

I need an explaination as to what is happening when I change the zone file of a DNSSEC enabled domain

I recently moved our hidden DNS master service to a new host, DNS38. The original master service is still running but is not being polled at the present time. The old master, and all the ...
user avatar
0 votes
1 answer
62 views

When setting up DNSSEC on Bind, which DNSKEY records belong in the zone file?

Should the zone file only contain the KSK's DNSKEY record, or should it contain the ZSK's DNSKEY record as well?
user avatar
  • 96
0 votes
0 answers
43 views

Reverting a DNS zone-file from manually-signed to "un-signed"

I have inherited a DNS server running BIND that is the master for one zone, it is DNSSEC-signed. For various reasons, I've decided to re-install this server as a new instance and enable inline-signing....
user avatar
0 votes
1 answer
181 views

Why does an authoritative name server not DNSSEC-validate its own results?

If I query a name server a record it is authoritative for it seems the answer does not get DNSSEC validated: $ dig cloudflare.com @ns3.cloudflare.com ; <<>> DiG 9.16.22-Debian <<>...
user avatar
0 votes
0 answers
110 views

Unbound recursive server not setting AD flag

I am running Unbound 1.9.0 as a recursive caching DNS server for a small branch office. It recurses over TLS towards cloudflare only and it has a typetransparent local-zone (example.com) overriding ...
user avatar
  • 131
0 votes
0 answers
206 views

How do I prevent Bind from retiring non-expiring DNSSEC keys when using DNSSEC Policy?

To control when signatures expire, I've switched to using dnssec-policy to generate DNSSEC records for my zones. This has solved the issue of getting RRSIG records to expire when they should but ...
user avatar
0 votes
1 answer
56 views

DNSSEC Migration with only KSKs migrated

Short version: If a DNSSec-signed sone suddenly replace both ZSK (and all records related to the old ZSK), and at the same time keep the KSKs (which are referenced to by upstream server). Will it ...
user avatar
  • 336
1 vote
1 answer
483 views

How do I extend the expiration date of every DNSSEC signature in bind9?

I have a dnssec-secured domain that needs to remain valid for 8 weeks when all masters become unreachable. To my understanding, setting sig-validity-interval to 64 7 in the zone's configuration file ...
user avatar
0 votes
1 answer
329 views

How to force BIND 9.16 to resign my zones after editing zone file

I'm using BIND 9.16 new dnssec-policy feature on my zones, following the guide to enable DNSSEC. Everything worked like a charm. Now, I need to add another record to one of my zones, but after editing ...
user avatar
0 votes
2 answers
76 views

What happens if a resolver encounters a DNSSEC algorithm it does not support?

Does it refuse to return the requested record, or does it return the record, treating the domain as unsecured?
user avatar
2 votes
2 answers
216 views

Is DNSSEC useful?

DNSSEC validate and authenticate zone data with the purposeto make sure that whatever DNS results, those are genuine. Even if a DNS resolver validates that an authoritative nameserver has send the ...
user avatar
  • 333
0 votes
0 answers
53 views

DNSSEC in Spain

I tried to set up DNSSEC for a .es domain. The nameservers are on Cloudflare and GoDaddy is the registrar. I wasn't able and then a 'GoDaddy Guide' (chat support) told me that DNSSEC would generally ...
user avatar
  • 163
0 votes
0 answers
87 views

Which DS record will a validator choose when there are multiple valid DS records?

If there are multiple DS records with each using a different but RFC-compliant algorithm and digest type, is there any way to predict how real world validators will select one? I've tried to, for ...
user avatar
  • 2,698
0 votes
1 answer
24 views

Transfer DNSSEC signed zones on GCP

I'm transferring zones between different Google Cloud Platform accounts which have been signed using DNSSEC. I've put the new zone into DNSSEC transfer state but when I try to load the DNSKEY into the ...
user avatar
6 votes
1 answer
350 views

SSHFP not working

I have two machines running OpenBSD v6.9. Let's be original and call them client and server. I generated the SSHFP records on the server with : ssh-keygen -r host.domain.tld In the DNS zone, I added ...
user avatar
1 vote
0 answers
77 views

Do clients need to validate DNSSEC signatures?

I'm tasked to configure our domain to use DNSSEC. We currently use AWS Route 53 as both our registrar and DNS hosting provider. According to the AWS documentation, Route 53 supports DNSSEC at both of ...
user avatar
  • 113
0 votes
1 answer
299 views

DNSSEC automatic signing isn't automatic

I'm having trouble with getting DNSSEC automatic signing to actually be automatic. It fails to sign automatically (well, it does sign automatically, but apparently signs the wrong thing, see below). ...
user avatar
  • 101
2 votes
1 answer
73 views

DNSSec do you need to renew anything?

I have followed this tutorial to configure DNSsec: https://www.digitalocean.com/community/tutorials/how-to-setup-dnssec-on-an-authoritative-bind-dns-server-2 If you don't modify your zone, do you ever ...
user avatar
  • 21
1 vote
1 answer
3k views

Bind9: Disable DNSSEC validation on per zone basis?

I am trying to make a caching / forwarding only DNS server using Bind9 with DNSSEC validation being enabled by default. Assume you have the following informations from my config file: acl "home-...
user avatar
0 votes
1 answer
190 views

Does DANE allow for trustable self-signed certificates?

DANE has 4 modes of operation indexed 0-3 with mode 3 i.e. Domain issued certificate allowing for self-signed certificates. Can this mode be used in a trustable manner? and if so does that mean that ...
user avatar
  • 101
0 votes
0 answers
26 views

does manually resigning a changed zone file with the same keys break the DNSSEC support from the upstream parent zone?

I send the ds set of example.company.com to my company.com provider. I also manage a couple of subdomains which are subject to change eventually: subdomain1.example.company.com and subdomain2.example....
user avatar
  • 127
0 votes
1 answer
685 views

On AWS during DS record creation I get an error, DS record with DNS name ex.com not permitted in zone ex.com. Why might this be?

Environment: AWS, DNSSEC When I attempt to create a DS record to establish a chain of trust I get an error that I don't understand. My full error. Error occurred Bad request. (InvalidChangeBatch 400: ...
user avatar
1 vote
0 answers
284 views

dig does not show the content of DS, DNSKEY or any DNSSEC related record, SERVFAIL

I want to see the content of records using dig but any RR related to DNSSEC comes up empty. This happens on two laptops of mine. I'm running Ubuntu 18.04. Is there any setting I can fix to stop ...
user avatar
  • 127
2 votes
1 answer
48 views

Webex not using DNSSEC

our government issued a statement that all video/voice online enabling software needs to use DNSSEC for all address translations and all used DNS servers need to support DNSSEC. I tried few DNSSEC ...
user avatar
0 votes
1 answer
393 views

What are good default settings for DNSSEC?

I use Google Domains and just opened an account with A2 Hosting. I'd like to keep using DNSSEC. A2 Hosting requires me to "Please open a support ticket and provide the following information: DS ...
user avatar
0 votes
0 answers
93 views

Different DNS records on offline local network with valid DNSSEC

This is pretty much DNS spoofing on local network including DNSSEC, but I believe it should be somehow possible since I'm the legitimate owner of the domain. I'm planning to provide a service during 1-...
user avatar
  • 109
0 votes
0 answers
27 views

My co.za domain name won't propagate

I bought a co.za domain name at Godaddy and changed the A record to point to Justhost. However the domain will not propagate. I checked https://dnschecker.org https://dnschecker.org. It's been over 72 ...
user avatar
5 votes
1 answer
4k views

opendkim-testkey: key not secure

I set up Opendkim milter to work with postfix on my machine. Now email is signed & verified correctly i.e. email source code shows DKIM-Signature header. TXT record on the authorative dns is set ...
user avatar
  • 317
1 vote
1 answer
94 views

DNSSEC - Google Cloud and Cloudflare - Which DS Record do I give to the Registrar?

I have managed to really confuse myself here with enabling DNSSEC for the first time ever. I am using Google Cloud compute engine running a WordPress website for hosting. My domain registrar has its ...
user avatar
0 votes
1 answer
121 views

DNSSEC - DNS/domain providers that enable DANE DNS records [closed]

Our company registered domain "example.eu" with Gandi which has a "one click solution" to enable the DNSSEC for our domain's zone. So we enabled it, waited until dnsviz inspection ...
user avatar
  • 317
1 vote
1 answer
2k views

Use of private and public DNS with DNSSEC

My company, 'example.com', has a public host www.example.com. The (legacy Windows managed) internal network has several internal hosts internalhost1.example.com, internalhost2.example.com and so on. ...
user avatar
  • 206
0 votes
1 answer
169 views

DNSSEC can easily be spoofed?

I want to know the purpose of DNSSEC, what problem does it really try to solve? I think DNSSEC can easily be spoofed by inserting a non-DNSSEC DNS server into the network that serves a non-DNSSEC copy ...
user avatar
  • 206
1 vote
1 answer
812 views

Removing DNSSEC - Can it be done, and how can I?

A little while ago, I deployed DNSSEC because in doing so I reduced the number of security configuration checks I needed to implement on my local domain's DNS. These are Windows Server 2012R2 ...
user avatar
2 votes
0 answers
229 views

Setup Knot DNS DNSSEC with automatic key management

I am new to DNS. I am trying to set up public authoratative dns servers for a dot net domain using Knot dns. Generally the documentation is pretty clear, but when it comes to DNSSEC it is confusing. ...
user avatar
  • 179
2 votes
1 answer
230 views

Issues running multiple BIND DNS servers behind a single Public IP

I am implementing a solution to load balance DNS queries across multiple bind recursive DNS servers to increase QPS limit Each centos VM has a namespace gi set up with the loopback of the ns set to ...
user avatar
0 votes
1 answer
105 views

How do I generate an SSHFP record from a remote ssh server (like a router)?

How do I generate an SSHFP DNS records for a server like a router that does not give you direct access to their keys in a format that ssh-keygen -r machine understands? The ssh-keygen -r machine reads ...
user avatar
0 votes
1 answer
364 views

DNS is only partially working after changing the provider

My website is ecoguardfilters.com. I bought a domain from GoDaddy and hosting is with Hostinger. I changed the nameserver to Hostinger, but it is still not fully propagated, after two weeks. What ...
user avatar
  • 3
3 votes
0 answers
856 views

DNSSEC for private internal sub zones of an external domain

Consider the following scenario: example.com is hosted on CloudFlare and it's signed by CloudFlare DNSSEC. Everything works as expected for example.com. Inside the company we have some internal ...
user avatar
1 vote
0 answers
196 views

Bind loading signed zone with outdated serial

I'm running BIND 9.16.3-Ubuntu (ISC PPA) on a primary DNS server with a split view setup of an internal and an external view. All zones are signed with inline signing and auto-dnssec maintain. Some ...
user avatar
  • 111
0 votes
1 answer
43 views

Existing RRSIG with KSK, but no DS record

When getting the key for domaindiscount24.net, I got: domaindiscount24.net. 3600 IN DNSKEY 257 3 7 AwEAAeKb+f8Taftu3DLQEVeHJTarZBQwZ9M1B9LpzldumDNwdLf3poYjcE04z30wQSw8NG+XXBaEzJ/...
user avatar
  • 77
1 vote
1 answer
218 views

DNSSEC I am not able to validate DNSKEY answer

Here is the answer I got for .com.my. DNSKEY: com.my. 3600 IN DNSKEY 257 3 8 BQEAAAABu3FxmZrMlOMXlk2I2LeTsoMre8QaJKw75gSH9G8VCNX6AaVo8hT8qQyfNWDtdM+...
user avatar
  • 11
4 votes
1 answer
939 views

How to migrate BIND configuration to dnssec-policy from auto-dnssec maintain without disruption?

BIND 9.16 introduced a new dnssec-policy feature as a further more automated DNSSEC key management and signing facility over the long established auto-dnssec maintain functionality. The documentation ...
user avatar
0 votes
1 answer
1k views

What does this bind error mean?

Background I'm trying to setup a recursive DNSSec Server, with the dnssec-lookaside option. Following this guide. Error Message root@dnssec:/home/jose# systemctl status bind9 ● bind9.service - BIND ...
user avatar