<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>On Sep 12, 2010, at 10:45 AM, Tony Finch wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div bgcolor="#FFFFFF"><div>I could not get private stub nor forward zones to work if their public parent is signed and does not have a delegation to the private zone.<br></div></div></blockquote><div><br></div><div>Does it work if the parent does have a DS record for the child covered by the stub zone? I would expect it would not do so, since with a stub zone, the resolver ought to start resolution right there, thus never seeing the parent's DS record.</div><div><br></div><div>Instead, add a trusted key for the stub zone.</div><div><br></div><div>Conceptually, a stub zone is like a root hints zone. You need a trusted key for the root in order to trust its DNSKEY. The same should be true of stub zones.</div><div><br></div><div>Disclaimer: I have not actually tested this. It's never come up as a problem I've had to solve; stub zones have typically been for internal DNS environments, where DNSSEC rollout has not been a priority.</div><div><br></div><div>Chris Buxton</div><div>BlueCat Networks</div><br><blockquote type="cite"><div bgcolor="#FFFFFF"><div>On 12 Sep 2010, at 03:41, Chris Buxton <<a href="mailto:chris.p.buxton@gmail.com">chris.p.buxton@gmail.com</a>> wrote:<br><br></div><div></div><blockquote type="cite"><div><span></span><br><span>On Sep 11, 2010, at 2:34 AM, Phil Mayers wrote:</span><font class="Apple-style-span" color="#94000E"><font class="Apple-style-span" color="#0023A3"><br></font></font><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>You'll need a:</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>zone "name" {</span><br></blockquote><blockquote type="cite"><span> type forward;</span><br></blockquote><blockquote type="cite"><span> forward only;</span><br></blockquote><blockquote type="cite"><span> forwarders {</span><br></blockquote><blockquote type="cite"><span> ips;</span><br></blockquote><blockquote type="cite"><span> };</span><br></blockquote><blockquote type="cite"><span>};</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>It won't automatically detect that another view contains the zone and redirect it; you have to tell it.</span><br></blockquote><span></span><br><span>Use a stub zone instead of a forward zone, so that the query will actually reach the authoritative view. With a forward zone, the query is recursive, so will be picked up by the recursive view - the view will query itself and not receive an answer.</span><br><span></span><br><span>zone "<a href="http://zone.name">zone.name</a>" {</span><br><span> type stub;</span><br><span> file "/path/to/recursive-view-data/zone.name";</span><br><span> masters { 127.0.0.1; }; // or whatever the correct IP is to reach the internal view</span><br><span>};</span><br></div></blockquote></div></blockquote></div><br></body></html>