Questions tagged [dnssec]

Domain Name System Security Extension is a specification for securing certain kinds of information provided by Domain Name System

Filter by
Sorted by
Tagged with
9 votes
1 answer
11k views

opendkim-testkey: key not secure

I set up Opendkim milter to work with postfix on my machine. Now email is signed & verified correctly i.e. email source code shows DKIM-Signature header. TXT record on the authorative dns is set ...
71GA's user avatar
  • 383
29 votes
3 answers
9k views

What kinds of security vulnerabilities does providing DNSSEC expose?

I was planning to sign my DNS zone with DNSSEC. My zone, the registrar and my DNS server (BIND9) all support DNSSEC. The only one who doesn't support DNSSEC is my secondary nameserver provider (namely ...
Johann Bauer's user avatar
5 votes
2 answers
19k views

bind9 configure forward zone for local domain without DNSSEC for this zone only

I have a working DNS server for local domain mydomain.local. I am trying to configure bind9 to work in default configuration, except for this zone, for which I want to forward queries to local DNS ...
galets's user avatar
  • 806
11 votes
2 answers
32k views

bind9 does not resolve dnssec correctly

I have a problem with my dns server setup. My bind server is mainly a cache-server but does also serve some internal domains. It listens only on my private network and serves only requests from there. ...
user avatar
9 votes
1 answer
12k views

How to remove DNSSEC support from a domain?

A organization has DNSSEC support for their domains. They have a BIND9 as authoritative name server running which also manages the keys. However it was decided to remove DNSSEC. Is it sufficient to ...
qbi's user avatar
  • 193
7 votes
1 answer
3k views

Multiple DS records

I was wondering how validating resolvers deal with multiple DS records. Let's say we have a zone with one KSK and one ZSK, but after some key rollover shenanigans there are two DS records in the ...
user997904's user avatar
6 votes
1 answer
5k views

DNSSEC NSEC3 opt-out

Can someone please explain, in simple language, the meaning of opt-out flag in the NSEC3 RR. I did read RFC 5155 and understand nothing.
Sandman4's user avatar
  • 4,095
6 votes
5 answers
4k views

DNSCurve vs DNSSEC

Can someone informed, please give a lengthy reply about the differences and advantages/disadvantages of both approaches? I am not a DNS expert, not a programmer. I have a decent basic understanding ...
Bill Gray's user avatar
  • 1,345
6 votes
1 answer
6k views

Basic DNSSEC configuration under BIND 9.7?

Could anybody provide a step-by-step procedure to set up DNSSEC under BIND 9.7? I think the version is relevant because it is supposed to make life easier. In fact, there is a document published by ...
sadpluto's user avatar
  • 183
5 votes
1 answer
17k views

Adding DS record to parent in DNS

I am trying to set up DNSSEC for my domains. Everything seems to work but I get the following error: DNSKEY found at child, but no DS was found at parent. Check for DS records in parent zone We found ...
Saif Bechan's user avatar
3 votes
1 answer
2k views

How do I remove a DS record from my parent zone using Amazon Route 53?

My website is currently inaccessible due to the presence of a DS record in the parent zone, when I am using nameservers that don't support DNSSEC. See this question for more context. I am using ...
Mark Fisher's user avatar
2 votes
1 answer
7k views

DNSSEC sign-zone results in fatal failure

I have a working DNS in a VM-env for testing and learning purposes. It's a complete server from root-domain and a couple of subdomains. I've added dnssec-enable yes; into named.conf, and also ...
Joakim Hellström's user avatar
0 votes
0 answers
883 views

How do I prevent Bind from retiring non-expiring DNSSEC keys when using DNSSEC Policy?

To control when signatures expire, I've switched to using dnssec-policy to generate DNSSEC records for my zones. This has solved the issue of getting RRSIG records to expire when they should but ...
Tenders McChiken's user avatar
0 votes
1 answer
521 views

DNSSEC key information for Bind 9

Is there a tool which allows me to view the parameters of an existing private/public key used for DNSSEC in Bind 9? I've been unable to determine simple things such as the expiration date, the ...
David M. Syzdek's user avatar