<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Keep in mind that the discussion is limited to an internal zone only. Running authoritative and recursive at the same time cannot be labeled as a “terribly
bad practice”:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><a href="https://kb.isc.org/docs/bind-best-practices-recursive">https://kb.isc.org/docs/bind-best-practices-recursive</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">“administrators may, for convenience, choose to serve some internal-only zones authoritatively from their recursive servers”<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">John<o:p></o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></a></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> bind-users [mailto:bind-users-bounces@lists.isc.org]
<b>On Behalf Of </b>Mark Elkins via bind-users<br>
<b>Sent:</b> Monday, August 1, 2022 1:12 PM<br>
<b>To:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> Re: DNSSEC signing of an internal zone gains nothing (unless??)<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p>Hmmm - might be saying the wrong thing but...<o:p></o:p></p>
<p>.SE was DNSSEC Signed waaay before the root, so if living in Sweden, one would prep your DNSSEC aware resolver with the DS Key of the .SE Zone. DNSSEC then worked for .SE domains. Perhaps do the same?<o:p></o:p></p>
<p>I do get confused further down in this email when one says you'll get back an "AA" flag in the answer. That will only happen if you ask the Authoritative Server for the domain you are looking in. That shouldn't be a Recursive server. It is terribly bad practice
to have a BIND server running in both Authoritative and Recursive mode at the same time - should be two separate instances of BIND.<o:p></o:p></p>
<div>
<p class="MsoNormal">On 8/1/22 7:51 PM, John W. Blue via bind-users wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre>Also do not disagree.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>However, the intent of the thread is to talk about the lack of an AD flag from a non-public internal authoritative server. Based upon what I am seeing only the AA flag is set.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>John<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>-----Original Message-----<o:p></o:p></pre>
<pre>From: John Franklin [<a href="mailto:franklin@sentaidigital.com">mailto:franklin@sentaidigital.com</a>] <o:p></o:p></pre>
<pre>Sent: Monday, August 1, 2022 12:45 PM<o:p></o:p></pre>
<pre>To: John W. Blue<o:p></o:p></pre>
<pre>Cc: <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><o:p></o:p></pre>
<pre>Subject: Re: DNSSEC signing of an internal zone gains nothing (unless??)<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>On Aug 1, 2022, at 12:15, John W. Blue via bind-users <a href="mailto:bind-users@lists.isc.org"><bind-users@lists.isc.org></a> wrote:<o:p></o:p></pre>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre><o:p> </o:p></pre>
<pre>As some enterprise networks begin to engineer towards the concepts of ZeroTrust, one item caught me unaware: PM’s asking for the DNSSEC signing of an internal zone.<o:p></o:p></pre>
<pre> <o:p></o:p></pre>
<pre>Granted, it has long been considered unwise by DNS pro’s with a commonly stated reason that it increasing the size of the zone yadda, yadda, yadda.<o:p></o:p></pre>
<pre> [snip]<o:p></o:p></pre>
<pre>Thoughts?<o:p></o:p></pre>
</blockquote>
<pre><o:p> </o:p></pre>
<pre>DNSSEC enables use of certain security RRs, such as SSHA and TLSA, which can be used as part of a zero trust solution in DevOps pipelines. It’s also good practice managing DNSSEC before deploying it in public production sites.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>jf<o:p></o:p></pre>
</blockquote>
<div>
<p class="MsoNormal">-- <o:p></o:p></p>
<p style="margin-bottom:12.0pt">Mark James ELKINS - Posix Systems - (South) Africa<br>
<a href="mailto:mje@posix.co.za">mje@posix.co.za</a> Tel: <a href="tel:+27826010496">
+27.826010496</a><br>
For fast, reliable, low cost Internet in ZA: <a href="https://ftth.posix.co.za">https://ftth.posix.co.za</a><br>
<br>
<o:p></o:p></p>
</div>
</div>
</body>
</html>