How to prepublish additional DNSKEY
klaus.darilion at nic.at
Wed Jul 8 08:52:42 UTC 2020
A signed zone shall be moved to another DNS provider. Hence I want to add the public KSK of the gaining DNS provider as additional DNSKEY to the zone. My setup ist:
Bind1 as hidden primary --> Bind2 as bump-in-the-wire signer -> public facing secondaries
I tried to add the DNSKEY to the zone file of Bind1. Bind1 accepts the DNSKEY. But Bind2 only shows the DNSKEYs from the local key-directory, the original DNSKEY is removed/ignored.
I also tried to add the additonal DNSKEY into the key-directory of Bind2 (no .private file, only .key file). It did not worked too.
So, how is the correct process to add an additional DNSKEY (only the public key is known).
More information about the bind-users