Questions tagged [dnssec]
Domain Name System Security Extension is a specification for securing certain kinds of information provided by Domain Name System
220
questions
0
votes
0
answers
20
views
Requirements for enabling DNSSEC in Split-Brain Bind9 DNS under a child zone?
I have a fairly complicated split-brain DNS setup, and I'm hoping to add DNSSEC to the ecosystem to support SSHFP (which requires DNSSEC). I am not totally sure I understand how this needs to work, ...
- 173
0
votes
1
answer
81
views
Bind9 signed zone SOA serial update does not reflect usigned serial
I am using BIND 9.18.28-0ubuntu0.24.04.1-Ubuntu to serve DNSSEC signed zones but when I update a zone the SOA serial for the signed zone does not relate to the unsigned SOA.
After the last update my ...
- 103
0
votes
1
answer
68
views
How to smoothly change DNS hosters without several hours of service outage?
I have recently changed my DNS hoster (again) as I needed some features which my previous DNS hoster does not provide. Everytime I changed DNS hosters my server became unavailable for several hours ...
- 301
1
vote
0
answers
59
views
Windows Server 2016 - DNS DSNSEC - I'm getting Error 9107 while trying signing
My Windows Server 2016 VPS machine, undergone change in IP address, and transfer into another hardware.
Since then, I tried to update my DNS record, but I got an error related to DNSSEC, and then I ...
- 153
0
votes
0
answers
34
views
Bind keeps resigning one zone and sending updates
I have multiple zones on a master NS server, which transfer to public faced servers.
But after enabling DNSSEC for every zone, one zone continues doing IXFR (has been doing it for 2 weeks now), every ...
- 1
0
votes
1
answer
304
views
DNSSEC validation failure
My provider transfered domain salonasruna.com, but it looks like it's not working properly.
https://dnssec-analyzer.verisignlabs.com/salonasruna.com shows status.
How to solve the problem and the ...
- 1
-2
votes
1
answer
211
views
Migrated from Google Domains to Cloudflare with DNSSEC turned on, how can I fix this?
While changing configuration to address the deprecation of Dynamic DNS in Google Domains October 2023 announcement, I changed the nameservers in Google Domains for my .org and .com domains to point to ...
1
vote
1
answer
250
views
How to best disable DNSSEC before onboarding to CloudFlare?
In order to avoid offline time for for a DK domain when onboarding them to CloudFlare, I have read this regarding disabling DNSSEC: https://developers.cloudflare.com/dns/dnssec/
Where is says:
If you ...
- 281
2
votes
0
answers
151
views
BIND DNSSEC Keys remain active although expired
Szenario:
BIND9 (9.18) running on Debian 12 "bookworm" as primary DNS for a whole bunch of zones.
A dnssec-policy is in place, which establishs automatic signing of zone entries.
Keys (KSK &...
- 121
0
votes
1
answer
335
views
How to set RRSIG signature expiry validity manually (BIND9)
The default Resource record signature validity is 30 days of bind9 and we have to renew the signature validity by resigning the zone file every time. Otherwise the DNS resolver will unable to resolve ...
0
votes
0
answers
321
views
Cloudflare edge certificates stuck on pending validation because of DNSSEC
I’ve added my domain to cloudflare around 15 hours ago and edge certificates is still stuck on pending.
I tried the help center and the answer I got was to test my website with https://letsdebug.net/ ...
0
votes
0
answers
21
views
Sending of DNSSEC-related records in DNS responses
If a DNS name server supports DNSSEC, does it mean that every DNS response it sends will include DNSSEC-related records, like NSEC, NSEC3, RRSIG, etc? Or does it depend on what the resolver sent?
I ...
- 211
0
votes
0
answers
32
views
Move Nameserver from crashed BIND servers (DNSSEC Enabled)
The situation basically is:
The BIND servers that are authoritative for a domain crashed and are utilizing DNSSEC (Ie; I can't change the DNS entries for the zone), is it enough to have the registrar ...
1
vote
0
answers
42
views
Can I add a Trust Anchor for a specific domain?
Some TLDs unfortunately still don't support DNSSEC all the way to the root. However, is it possible to add a specific DNSKEY to my resolver (currently using knot-resolver) so that a signed zone can ...
- 489
0
votes
0
answers
121
views
DNSSEC - Unable to sign the relevant files
I have set up a working DNS server on an Ubuntu 22.04 LTS as part of a single server (DNS, SPF, Email, firewall etc)
IP: 192.168.122.189
Test Domain: jetj.ltd
Hostname:mail
The files I have are:
db....
- 1
2
votes
1
answer
738
views
Understanding RRSIG DNS query
Is the presence of RRSIG highly uncommon? I tried to fetch RRSIG records for many popular domains including trying out different resolver. I didn't get any RRSIG records in the answer section.
dig @1....
- 327
1
vote
2
answers
6k
views
Certbot error - DNSSEC: DNSKEY Missing
I moved my domain to Route53 and am now getting problems with Certbot renewal. Certbot has been running great for 4 years, but is now failing to renew.
When running sudo certbot renew --apache i get ...
- 111
0
votes
1
answer
250
views
Why can't I activate DNSSEC for Domains with a gg ccTLD, despite the fact that there are many domains, which have a valid signature?
This is my first question and hope that I'm in the right community. I bought a gg Domain a while ago and wanted, later needed, DNSSEC. After the purchase I encountered the problem, that I can not ...
- 1
0
votes
1
answer
571
views
BIND DNS - DNSSEC on Internal Private Domain
Question regarding DNSSEC.
I have a internal private TLD eg. corp. Underneath that are multiple subdomains eg. region-a.corp, region-b.corp etc. And possibly underneath the regions, there are further ...
- 1
0
votes
1
answer
1k
views
opendkim-testkey: key not secure (file permissions are good and TrustAnchorFile config setting is set)
If I run sudo opendkim-testkey -d mydomain.com -s selector -vvv, I get
opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: checking key 'selector._domainkey.mydomain.com'
...
0
votes
1
answer
623
views
How do i enable DNSSEC on NameSilo (using DS records form YDNS)
(First of all i am new to domains in general and DNSSEC).
I have tried to enable DNSSEC on NamesSilo for my domain.
I only have the ds records in plane text and don't know wich value has to be ...
- 3
2
votes
1
answer
254
views
BIND auto-dnssec is signing records with ZSK and KSK
I'm doing a rollover of my KSK and ZSK (concurrent with a server transfer) and BIND (version 9.16.23) has started causing problems for me. I have the following keys in my directory:
; Kexample.ca.+007+...
- 974
2
votes
1
answer
285
views
Migrating signed zones between BIND servers
I'm having some troubles migrating a signed DNS zone to a new server. I've copied over the zone files (unsigned, signed, and journal), signing keys, and DS sets. Once in place, BIND is happy to serve ...
- 974
0
votes
1
answer
1k
views
Securing DNS: Is combining Unbound with DNSMASQ and DNSCrypt Proxy necessary or beneficial on a Debian 11 system?
I've recently taking an intrest in DNS security and have opted to use the "dnsrypt-proxy", "dnsmasq" and "unbound" packages on my Debian 11 system chained together in the ...
13
votes
2
answers
2k
views
How is my DNSSEC enabled domain still serving a tiny number of NXDOMAIN response codes?
I enabled DNSSEC on my primary domain about a week ago. It's not a major website or anything -- just my personal domain name that I use for email and the like (TLD: com; DNSSEC algorithm 13; ...
- 165
2
votes
1
answer
579
views
Remove RRSIG record from GoDaddy subdomain
I added 4 NS entries for a subdomain for a SalesForce email campaign.
SalesForce has since complained they see an "RRSIG entry for the subdomain" and they "do not support (add to NS) ...
- 143
0
votes
0
answers
407
views
Is it possible to have different internal and public DNS with DNSSEC?
I'm attempting to achieve the following:
A public nameserver for my domain which points example.com to a public IP address.
A private nameserver for the same domain running within a LAN which instead ...
- 471
2
votes
2
answers
3k
views
Configuring BIND9 (ver 9.16) to allow TXT DNS updates from Letsncrypt
Solution to the below problem: Use $ddns-confgen or $tsig-keygen, the former provides you with the syntax to paste into your named.conf file
Problem:
I am trying to configure a BIND9 (ver9.161-Ubuntu) ...
- 29
1
vote
2
answers
3k
views
How Do I Fix My DNSSEC? I never got DNSSEC working and have probably worsened the problems
My attempt to DNSSEC has not been successful.
To help understand DNSSEC I have read many online articles, man pages for rndc, dnssec-*, viewed dnsviz.net and dnssec-analyzer.verisignlabs.com/. Most of ...
- 21
0
votes
1
answer
2k
views
BIND 9.16 dnssec-policy default is not automatically renewing keys
Three months ago I upgraded my DNS servers to BIND 9.16 (currently running 9.16.25) to take advantage of the new dnssec-policy default option which would allow me to easily run DNSSEC for my domains. ...
0
votes
1
answer
234
views
I need an explaination as to what is happening when I change the zone file of a DNSSEC enabled domain
I recently moved our hidden DNS master service to a new host, DNS38. The original master service is still running but is not being polled at the present time.
The old master, and all the ...
- 367
0
votes
1
answer
476
views
When setting up DNSSEC on Bind, which DNSKEY records belong in the zone file?
Should the zone file only contain the KSK's DNSKEY record, or should it contain the ZSK's DNSKEY record as well?
- 116
0
votes
1
answer
955
views
Why does an authoritative name server not DNSSEC-validate its own results?
If I query a name server a record it is authoritative for it seems the answer does not get DNSSEC validated:
$ dig cloudflare.com @ns3.cloudflare.com
; <<>> DiG 9.16.22-Debian <<>...
- 396
1
vote
0
answers
1k
views
How do I prevent Bind from retiring non-expiring DNSSEC keys when using DNSSEC Policy?
To control when signatures expire, I've switched to using dnssec-policy to generate DNSSEC records for my zones. This has solved the issue of getting RRSIG records to expire when they should but ...
- 141
0
votes
1
answer
261
views
DNSSEC Migration with only KSKs migrated
Short version: If a DNSSec-signed sone suddenly replace both ZSK (and all records related to the old ZSK), and at the same time keep the KSKs (which are referenced to by upstream server). Will it ...
- 336
1
vote
1
answer
3k
views
How do I extend the expiration date of every DNSSEC signature in bind9?
I have a dnssec-secured domain that needs to remain valid for 8 weeks when all masters become unreachable.
To my understanding, setting sig-validity-interval to 64 7 in the zone's configuration file ...
- 141
0
votes
1
answer
1k
views
How to force BIND 9.16 to resign my zones after editing zone file
I'm using BIND 9.16 new dnssec-policy feature on my zones, following the guide to enable DNSSEC. Everything worked like a charm.
Now, I need to add another record to one of my zones, but after editing ...
- 101
0
votes
2
answers
536
views
What happens if a resolver encounters a DNSSEC algorithm it does not support?
Does it refuse to return the requested record, or does it return the record, treating the domain as unsecured?
- 141
3
votes
2
answers
881
views
Is DNSSEC useful?
DNSSEC validate and authenticate zone data with the purposeto make sure that whatever DNS results, those are genuine.
Even if a DNS resolver validates that an authoritative nameserver has send the ...
- 383
0
votes
0
answers
73
views
DNSSEC in Spain
I tried to set up DNSSEC for a .es domain. The nameservers are on Cloudflare and GoDaddy is the registrar. I wasn't able and then a 'GoDaddy Guide' (chat support) told me that DNSSEC would generally ...
- 201
0
votes
0
answers
226
views
Which DS record will a validator choose when there are multiple valid DS records?
If there are multiple DS records with each using a different but RFC-compliant algorithm and digest type, is there any way to predict how real world validators will select one?
I've tried to, for ...
- 3,197
0
votes
1
answer
54
views
Transfer DNSSEC signed zones on GCP
I'm transferring zones between different Google Cloud Platform accounts which have been signed using DNSSEC. I've put the new zone into DNSSEC transfer state but when I try to load the DNSKEY into the ...
google-cloud-platform
10
votes
1
answer
2k
views
SSHFP not working
I have two machines running OpenBSD v6.9.
Let's be original and call them client and server.
I generated the SSHFP records on the server with :
ssh-keygen -r host.domain.tld
In the DNS zone, I added ...
- 101
1
vote
0
answers
300
views
Do clients need to validate DNSSEC signatures?
I'm tasked to configure our domain to use DNSSEC. We currently use AWS Route 53 as both our registrar and DNS hosting provider. According to the AWS documentation, Route 53 supports DNSSEC at both of ...
- 113
0
votes
2
answers
1k
views
DNSSEC automatic signing isn't automatic
I'm having trouble with getting DNSSEC automatic signing to actually be automatic. It fails to sign automatically (well, it does sign automatically, but apparently signs the wrong thing, see below). ...
- 101
2
votes
1
answer
626
views
DNSSec do you need to renew anything?
I have followed this tutorial to configure DNSsec:
https://www.digitalocean.com/community/tutorials/how-to-setup-dnssec-on-an-authoritative-bind-dns-server-2
If you don't modify your zone, do you ever ...
- 21
4
votes
2
answers
13k
views
Bind9: Disable DNSSEC validation on per zone basis?
I am trying to make a caching / forwarding only DNS server using Bind9 with DNSSEC validation being enabled by default.
Assume you have the following informations from my config file:
acl "home-...
- 1,215
0
votes
1
answer
517
views
Does DANE allow for trustable self-signed certificates?
DANE has 4 modes of operation indexed 0-3 with mode 3 i.e. Domain issued certificate allowing for self-signed certificates. Can this mode be used in a trustable manner? and if so does that mean that ...
- 111
0
votes
0
answers
112
views
does manually resigning a changed zone file with the same keys break the DNSSEC support from the upstream parent zone?
I send the ds set of example.company.com to my company.com provider. I also manage a couple of subdomains which are subject to change eventually: subdomain1.example.company.com and subdomain2.example....
- 131
0
votes
2
answers
3k
views
On AWS during DS record creation I get an error, DS record with DNS name ex.com not permitted in zone ex.com. Why might this be?
Environment: AWS, DNSSEC
When I attempt to create a DS record to establish a chain of trust I get an error that I don't understand.
My full error.
Error occurred
Bad request.
(InvalidChangeBatch 400: ...
- 609