When setting up DNSSEC on Bind, which DNSKEY records belong in the zone file?

ADS103

4/3/23, 4:18 PM

Should the zone file only contain the KSK's DNSKEY record, or should it contain the ZSK's DNSKEY record as well?

0 + 0

bind

dnssec

Score:2

Server

Patrick Mevzek

4/3/23, 5:11 PM

All.

Because the parent has a DS record which is, in summary, a hash of the KSK. Hence, when following the chain of trust the recursive resolve will fetch that DS record from parent, and will fetch the DNSKEY record from child, and will check that there is at least one key in the DNSKEY record matching the DS record and then continue the validation (or else fail it immediately there).

Per §2.1.1. of RFC4034, each DNSKEY record has a flags attribute that will allow a resolver to know if this given crypto material is for a zone key or a key signing key.

Note that the KSK/ZSK split is common, but not the only case. You have also a CSK situation with C=Common where you have a single key, that both signs directly all other records and also has a matching DS record at parent.

Both are valid setups, with different benefits and drawbacks.

Also note that the DNSKEY record set can even contain keys not yet used for signing nor being at parent in a DS record, which happens for example during rotation (you first need to introduce the key in the zone and let resolvers cache it, then after some time you can begin signing with it, and then again after some time you can enable the relevant DS record if needed).

0 + 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: When setting up DNSSEC on Bind, which DNSKEY records belong in the zone file?

TH: เมื่อตั้งค่า DNSSEC บน Bind ระเบียน DNSKEY ใดที่อยู่ในไฟล์โซน

RO: Când configurați DNSSEC pe Bind, ce înregistrări DNSKEY aparțin fișierului de zonă?

RU: При настройке DNSSEC на Bind, какие записи DNSKEY принадлежат файлу зоны?

VI: Khi thiết lập DNSSEC trên Bind, bản ghi DNSKEY nào thuộc tệp vùng?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.