Here is the solution:
Bind9 is set up with "dns-policy default" as depicted in the option section above. This is important and very cool. Most of help and documentation do not address "dns-policy default" but addresses "dns-policy default" in terms of previous, older and even deprecated methods.
1.Comment out all zones configurations in named.conf except one, for example example.com.
zone "example.com" {
type master;
file "/.../example.com.outsideView/example.com.outside";
key-directory "/.../zoneFiles/outsideView/example.com.outside";
};
a) file is the location of example.com zone file. I separate inside and outside views and make clear which view the zone file represents, thus example.com.outside.
b) key-directory is the location where the DNSSEC keys will be written and where a copy of example.com is placed. It is important to keep separate the zone file, example.com, in bind9 configuration, name.conf ie. file and the zone file, example.com, copied to key-directory as given as the name.conf option. You will modify the zone file, example.com, in file as needed. It is the working copy. The copy of zone file, example.com, in key-directory will be modified or "signed" by DNSSEC "dnssec-policy default".
2.Once the bind9 options for the zone configuration file are set with file and key-directoy then,
a) Restart bind with "systemctl restart bind9" or "rndc reload". "rndc reload" will reload the configuration files and zones. When the interaction of DNSSEC with bind and zone configurations was not understood I used "rndc reload". As things became clear then "systemctl restart bind9" was sufficient.
b) Once bind9 has been successfully restarted cd to key-directory. There will be the zone file example.com.outside, .jnl and K.(key|state|private) file like these:
example.com.outside
example.com.outside.jnl
Kexample.com.+013+12345.key
Kexample.com.+013+12345.state
Kexample.com.+013+12345.private
(013 - algorithm number, 12345 - key)
3)Extract the DS record from the key using the following command and save the output
a) dnssec-dsfromkey Kexample.com.outside+013+12345.key > DSkeyexample.com.outside.
b) DSkeyexample.com.outside will contain the DS record for the zone example.com in the file example.com.outside, for example, cat DSkeyexample.com.outside produces:
example.com. IN DS 12345 13 2
1234adb69784efc7528746dab15432abfd78764cd543cccd5432123abcdef123
c) Send the DS record to the ISP or input this DS record into the ISP's DNSSEC interface.
4)Signing the zone, example.com (filename example.com.outside).
Remember, the zone example.com is located in two places: file and copied to key-directory. example.com located in bind configuration "file" is for changes and modifications. Zone file example.com copied to bind configuration "key-directory" is signed by DNSSEC.
a) Initially, both zone files will be the same small size i.e. identical of course, for example 8KB. When signing takes place the zone file in key-directory will double quadruple in size, for example from 8KB to 24KB. Also, using an editor, open the zone file located in key-directory. Notice the signing data. Signing the zone is when DNSSEC rewrites the zone file in key-directory. "dnssec-policy default" signs and maintains the zone.
b) Zone signing does not always take place immediately. Use "systemctl status bind9" to observed the next key update to get an indication when the zone maybe signed.
5)Making changes/correction to the zone file
a) Do not change or modify the signed or unsigned zone file in key-directory. Change and modify the zone file in file and save it and remember to increment the Serial number. Then copy or save-as the changes to key-directory. Yes, the signed or unsigned zone file will be over written.
b) restart bind9: systemctl restart bind9.
6)Forcing the zone to sign. When bind9 is running and there are no errors but the zone will not sign.
a) remove/delete the *.jnl file and increment the serial of the zone file located in file. Then copy/save-as to key-directory. Then systemctl restart bind9.
b) Using rndc command to force signing. See man rndc
rndc flush - Flushes the server's cache.
rndc flushname name [view] - Flushes the given name from the view's DNS cache and, if applicable, from the view's nameserver address database, bad server cache and SERVFAIL cache.
rndc flushtree name [view] - Flushes the given name, and all of its subdomains, from the view's DNS cache, address database, bad server cache, and SERVFAIL cache.
managed-keys (status | refresh ) [class [view]]
c) The commands above seems to work better in conjunction with rndc freeze and rndc thaw. First use rndc freeze, issue the above command(s), then rndc thaw. After rndc thaw, I redundantly issue systemctl restart bind9. Because it seems to work better.
7)Check DNSSEC using https://dnsviz.net/ and https://dnssec-analyzer.verisignlabs.com/
When the first zone is DNSSEC uncomment another zone and work through the steps. The write up is much longer and harder than actually going through the steps to get DNSSEC working.
