<div dir="ltr"><div dir="ltr"><div dir="ltr">Thanks a lot to all of you....Now I understand.<div><br></div><div>But when I check for the DNSEC support with:</div><div><br></div><div>dig <a href="http://com.uk">com.uk</a> +dnssec +multi</div><div><br></div><div>I can see there is no support at all...so use DNSSEC for <a href="http://xxx.com.uk">xxx.com.uk</a> has no sense at all....hasn't it?</div><div><br></div><div><div>; <<>> DiG 9.10.3-P4-Debian <<>> <a href="http://com.uk">com.uk</a> +dnssec +multi</div><div>;; global options: +cmd</div><div>;; Got answer:</div><div>;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 55494</div><div>;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 8, ADDITIONAL: 1</div><div><br></div><div>;; OPT PSEUDOSECTION:</div><div>; EDNS: version: 0, flags: do; udp: 4096</div><div>;; QUESTION SECTION:</div><div>;<a href="http://com.uk">com.uk</a>. IN A</div><div><br></div><div>;; AUTHORITY SECTION:</div><div>uk. 1548 IN SOA <a href="http://dns1.nic.uk">dns1.nic.uk</a>. <a href="http://hostmaster.nic.uk">hostmaster.nic.uk</a>. (</div><div> 1403852443 ; serial</div><div> 7200 ; refresh (2 hours)</div><div> 900 ; retry (15 minutes)</div><div> 2419200 ; expire (4 weeks)</div><div> 10800 ; minimum (3 hours)</div><div> )</div><div>uk. 1548 IN RRSIG SOA 8 1 172800 (</div><div> 20181019160738 20181005150738 43056 uk.</div><div> obD8WjHpNUB/GeEdlp2SaJBsp9D0N03cLTCpEn+0UpQF</div><div> V75NiX509EzgTeT9Eh0du0kIptjMZKyDON/5ZN7p21BI</div><div> E3srTdrMVTNyNqAEa1SZWlTBWcs4FNzFoVkJVfJXwHpF</div><div> IDF2ZLlNxjlP9xgWr+YKcEtqUTYF4lfscx5tOF8= )</div><div><a href="http://m3q6e6871m2p91qts9clvtgqbl1vua1i.uk">m3q6e6871m2p91qts9clvtgqbl1vua1i.uk</a>. 1548 IN RRSIG NSEC3 8 2 10800 (</div><div> 20181018194223 20181004184445 43056 uk.</div><div> RH6cfZjzah93ucxwynKropExMhvWznqV4ySiWAsWLw3T</div><div> 3IaCQoF/rS5Np/PwcuIzZ5ZLR0dJ/56prKWSKA6l5LBz</div><div> 4dQWvlceb8oY3o1WvBXn/+UjptIMP87LPtNLxU/JsrGJ</div><div> YpO6qsBZXTerhmEAAZi+9tLBCo5dW5CO8n5PlP0= )</div><div><a href="http://m3q6e6871m2p91qts9clvtgqbl1vua1i.uk">m3q6e6871m2p91qts9clvtgqbl1vua1i.uk</a>. 1548 IN NSEC3 1 1 0 - (</div><div> M4FDARQNDI0P0UGAD29OKGNPRJKAE5SP</div><div> NS DS RRSIG )</div><div><a href="http://u1fmklfv3rdcnamdc64sekgcdp05bbiu.uk">u1fmklfv3rdcnamdc64sekgcdp05bbiu.uk</a>. 1548 IN RRSIG NSEC3 8 2 10800 (</div><div> 20181019000937 20181004233936 43056 uk.</div><div> ca9n8B+3hjnDKh8KHsM5gDGYq9bJ4Rjh/EQ7fVSO4FK4</div><div> VDDFtzhDvQySLfudSq3P0pGdqye/BLjTgC6p4pNUeFhL</div><div> SPjJsjcA5SvSha7ZNGgAjjdC4t7Sg0yyGnLxfx129lX2</div><div> AbhbpJUjCQ5eX6U56t2IH5/8Dg8uAPOFUF6Ogmk= )</div><div><a href="http://u1fmklfv3rdcnamdc64sekgcdp05bbiu.uk">u1fmklfv3rdcnamdc64sekgcdp05bbiu.uk</a>. 1548 IN NSEC3 1 1 0 - (</div><div> U1LG7J6JO1NFSU55LON2UMGEUJO912TU</div><div> NS SOA RRSIG DNSKEY NSEC3PARAM</div><div> TYPE65534 )</div><div><a href="http://uj4hvltjom8uroed1a11c346ko9rcp7a.uk">uj4hvltjom8uroed1a11c346ko9rcp7a.uk</a>. 1548 IN RRSIG NSEC3 8 2 10800 (</div><div> 20181018165433 20181004163523 43056 uk.</div><div> Tt5nrfM6nuJOgMPjULGi2WIN5RB3EZmv+nqODimBe5x8</div><div> 9axQltyX7OR8iHNR6DzQl33aABgfvC/htUpKmtvOlQ6P</div><div> 6V+2f/1I021Qcnuo7thu3V3a+ad1XFfHp6IqpEHi0Qxz</div><div> H4OsgvzFoycF+v0xpSr4ZSeuElJ0whKBlGWKAuM= )</div><div><a href="http://uj4hvltjom8uroed1a11c346ko9rcp7a.uk">uj4hvltjom8uroed1a11c346ko9rcp7a.uk</a>. 1548 IN NSEC3 1 1 0 - (</div><div> UJSIFQNCG7CTSHF49P4L7HNBMPOSGRMB</div><div> NS DS RRSIG )</div><div><br></div><div>;; Query time: 0 msec</div><div>;; SERVER: 172.17.10.25#53(172.17.10.25)</div><div>;; WHEN: Fri Oct 05 13:12:28 -03 2018</div><div>;; MSG SIZE rcvd: 1011</div></div><div><br></div><div><br><div>Regards!!!</div><div><br></div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr">El vie., 5 oct. 2018 a las 12:58, Chris Thompson (<<a href="mailto:cet1@cam.ac.uk">cet1@cam.ac.uk</a>>) escribió:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Oct 4 2018, Mark Elkins wrote:<br>
<br>
>On 10/04/2018 05:03 PM, Roberto Carna wrote:<br>
[...]<br>
>> I have two DNS servers running BIND 9.10, they have delegated my own<br>
>> domain, let's say "<a href="http://robert.com.uk" rel="noreferrer" target="_blank">robert.com.uk</a> <<a href="http://robert.com.uk" rel="noreferrer" target="_blank">http://robert.com.uk</a>>" and some<br>
>> other domains from our clients, let's say:<br>
>><br>
>> <a href="http://client1.com.uk" rel="noreferrer" target="_blank">client1.com.uk</a> <<a href="http://client1.com.uk" rel="noreferrer" target="_blank">http://client1.com.uk</a>><br>
>> <a href="http://client2.edu.uk" rel="noreferrer" target="_blank">client2.edu.uk</a> <<a href="http://client2.edu.uk" rel="noreferrer" target="_blank">http://client2.edu.uk</a>><br>
>> <a href="http://client3.info.uk" rel="noreferrer" target="_blank">client3.info.uk</a> <<a href="http://client3.info.uk" rel="noreferrer" target="_blank">http://client3.info.uk</a>><br>
>><br>
>> Can I sign theses client zones with my ZSK, or do I have to have a<br>
>> different key for each domain?<br>
><br>
>I believe common practise is to create separate KSK and ZSK keys for<br>
>each domain - so each domain will have their own DS records in the<br>
>parent. This way, if one of the clients moves their domain to a new DNS<br>
>provider - there is no security conflict in the move from shared keys.<br>
<br>
Even if you make the (RDATA of) the KSKs identical for the different zones<br>
the DS records you will need to insert into the parent zones will be<br>
different, because the hashing algorithm includes the KSK owner name<br>
(i.e. the zone name) in its input. See RFC 4034 section 5.1.4.<br>
<br>
Similarly using ZSKs with identical RDATA in the different zones will<br>
not make any of the RRSIGs the same (e.g. for the www.[zonename] RRs<br>
in different zones), because the full owner name is included in the<br>
hashing input.<br>
<br>
>(Use a different Key)<br>
<br>
Yes. Because there are no advantages whatsoever in doing otherwise!<br>
<br>
-- <br>
Chris Thompson<br>
Email: <a href="mailto:cet1@cam.ac.uk" target="_blank">cet1@cam.ac.uk</a><br>
<br>
<br>
<br>
_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</blockquote></div>