<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">Delegate the zone. Do NOT add a DS for it.<br><br><div dir="ltr">-- <div>Mark Andrews</div></div><div dir="ltr"><br><blockquote type="cite">On 17 Aug 2021, at 23:47, Edwardo Garcia <wdgarc88@gmail.com> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><div dir="ltr"><div>Hola</div><div><br></div><div>We have dnssec working for long time but need now to have a subdomain excluded, we are going to be use it to replace an internal blacklist, we have 14 smtp servers and it is cumbersome to keep in sync.</div><div><br></div><div>So we have <a href="http://example.net">example.net</a> signed,</div><div>but we want <a href="http://black.example.net">black.example.net</a>, and of course all addresses under, eg: <a href="http://4.3.2.1.black.example.net">4.3.2.1.black.example.net</a> to work, at present of course this presents SERVFAIL because dnssec, obvious "black" needs to be in <a href="http://example.net">example.net</a> zone, nd its dns is ns999 whichwork when dnssec disabled but this is not optimum<br></div><div><br></div><div> looking for suggestion or guidance to how we fix this please? Ir this is not possible?<br></div><div><br></div></div>
<span>_______________________________________________</span><br><span>Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list</span><br><span></span><br><span>ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.</span><br><span></span><br><span></span><br><span>bind-users mailing list</span><br><span>bind-users@lists.isc.org</span><br><span>https://lists.isc.org/mailman/listinfo/bind-users</span><br></div></blockquote></body></html>