<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Georgia, serif" size="2">
<div><i>Hi,</i></div>
<div> </div>
<div><i>I have question</i><i>s</i><i> about how to configure the DNS with NS delegation record </i><i>once</i><i> it</i><i>’s signed.</i></div>
<div> </div>
<div><i>My DNS server is the parent zone, for example, “testing.net” and </i><i>is signed with DNSSEC. </i><i>My zone configuration is as follows:</i></div>
<div><font face="Calibri, sans-serif"> </font></div>
<div><i>$TTL 36000</i></div>
<div><i>$INCLUDE /</i><i>var</i><i>/named9/dnssec-</i><i>testing</i><i>/K</i><i>testing.net.</i><i>.+007+</i><i>32934</i><i>.key ; key signing key</i></div>
<div><i>$INCLUDE /</i><i>var</i><i>/named9/dnssec-</i><i>testing</i><i>/K</i><i>testing.net</i><i>.+007+</i><i>46725</i><i>.key ; zone signing key </i></div>
<div><i>$INCLUDE /</i><i>var</i><i>/named9/dnssec-</i><i>testing</i><i>/K</i><i>testing.net</i><i>.+007+</i><i>32367</i><i>.key ; pre-published zone signing key</i></div>
<div><i>@ IN SOA </i><i>dns1.testing.net</i><i>. </i><i>root.testing.net</i><i>. (2011031200 3600 600 1209600 14400)</i></div>
<div> </div>
<div><i>Testing.net</i><i>. IN NS dns1.</i><i>testing.net</i><i>.</i></div>
<div><i>Testing.net</i><i>. IN NS dns2.</i><i>testing.net</i><i>.</i></div>
<div><i>www IN A </i><i>168.168.168.168</i></div>
<div><i>access</i><i> IN </i><i>NS</i><i> </i><i>sub1.testing.net.</i></div>
<div> </div>
<div><i>As of right now, the “sub1.testing.net” isn’t DNSSEC compliant yet. We want sub1.testing.net to be DNSSEC aware</i><i>. </i></div>
<div> </div>
<div><i>My question is, do we (as parent of testing.net zone) need to generate the key</i><i> (KSK) and zone key (ZSK) for the “sub1.testing.net” or should “sub1.testing.net” server will need to do that</i><i>?</i><i> If they generate the keys to sign all the
records in their server, do they need to send us their key file</i><i>s</i><i>?</i><i> How do we (as parent) to include those keys in our zone file? </i></div>
<div><font face="Calibri, sans-serif"> </font></div>
<div><i>Thanks,</i></div>
<div><font size="3" color="#0000FF"><i>Linh Khuu<br>
</i></font></div>
<div><font face="Calibri, sans-serif"> </font></div>
<div><font face="Calibri, sans-serif"> </font></div>
</font>
</body>
</html>