<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hmmm - might be saying the wrong thing but...</p>
<p>.SE was DNSSEC Signed waaay before the root, so if living in
Sweden, one would prep your DNSSEC aware resolver with the DS Key
of the .SE Zone. DNSSEC then worked for .SE domains. Perhaps do
the same?<br>
</p>
<p>I do get confused further down in this email when one says you'll
get back an "AA" flag in the answer. That will only happen if you
ask the Authoritative Server for the domain you are looking in.
That shouldn't be a Recursive server. It is terribly bad practice
to have a BIND server running in both Authoritative and Recursive
mode at the same time - should be two separate instances of BIND.<br>
</p>
<div class="moz-cite-prefix">On 8/1/22 7:51 PM, John W. Blue via
bind-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:cf806ae773d6441b842df0b889d6acd9@mail.rrcic.com">
<pre class="moz-quote-pre" wrap="">Also do not disagree.
However, the intent of the thread is to talk about the lack of an AD flag from a non-public internal authoritative server. Based upon what I am seeing only the AA flag is set.
John
-----Original Message-----
From: John Franklin [<a class="moz-txt-link-freetext" href="mailto:franklin@sentaidigital.com">mailto:franklin@sentaidigital.com</a>]
Sent: Monday, August 1, 2022 12:45 PM
To: John W. Blue
Cc: <a class="moz-txt-link-abbreviated" href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a>
Subject: Re: DNSSEC signing of an internal zone gains nothing (unless??)
On Aug 1, 2022, at 12:15, John W. Blue via bind-users <a class="moz-txt-link-rfc2396E" href="mailto:bind-users@lists.isc.org"><bind-users@lists.isc.org></a> wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">
As some enterprise networks begin to engineer towards the concepts of ZeroTrust, one item caught me unaware: PM’s asking for the DNSSEC signing of an internal zone.
Granted, it has long been considered unwise by DNS pro’s with a commonly stated reason that it increasing the size of the zone yadda, yadda, yadda.
[snip]
Thoughts?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
DNSSEC enables use of certain security RRs, such as SSHA and TLSA, which can be used as part of a zero trust solution in DevOps pipelines. It’s also good practice managing DNSSEC before deploying it in public production sites.
jf
</pre>
</blockquote>
<div class="moz-signature">-- <br>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<title></title>
<p>Mark James ELKINS - Posix Systems - (South) Africa<br>
<a class="moz-txt-link-abbreviated" href="mailto:mje@posix.co.za">mje@posix.co.za</a> Tel: <a href="tel:+27826010496">+27.826010496</a><br>
For fast, reliable, low cost Internet in ZA: <a
href="https://ftth.posix.co.za">https://ftth.posix.co.za</a><br>
<br>
<br>
</p>
</div>
</body>
</html>