<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div>I have a simple “mylocal” zone setup with a primary and secondary server.</div><div><br></div>my primary has this .jnl file:<div><br></div><div><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><span style="font-variant-ligatures: no-common-ligatures">mylocal.jnl</span></p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><span style="font-variant-ligatures: no-common-ligatures"><br></span></p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><span style="font-variant-ligatures: no-common-ligatures">My secondary has this similar .jnl file:</span></p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><span style="font-variant-ligatures: no-common-ligatures"><br></span></p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><span style="font-variant-ligatures: no-common-ligatures"></span></p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><span style="font-variant-ligatures: no-common-ligatures">mylocal.saved.jnl</span></p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><span style="font-variant-ligatures: no-common-ligatures"><br></span></p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><span style="font-variant-ligatures: no-common-ligatures">which I believe was distributed via zone transfer. You find no such similar files on your secondary?</span></p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><span style="font-variant-ligatures: no-common-ligatures"><br></span></p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><span style="font-variant-ligatures: no-common-ligatures">If you </span></p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><br></p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;">dig @<some IP> <somehost>.<somedomain>. A +dnssec +multiline</p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><br></p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;">where <some IP> is the IP of your recursive server and <somehost>.<somedomain>. is something in the domain you are trying to verify the DNSSEC is working.</p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><br></p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;">Does your flags line look something like this? </p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><br></p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;">;; flags: qr rd ra ad;</p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><br></p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;">Per the manual:</p><p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><br></p><p style="margin: 0px; font-stretch: normal; line-height: normal;"><font face="Menlo"><span style="font-size: 11px;">The important detail in this output is the presence of the ad flag in the header. This signifies that BIND has retrieved all related DNSSEC information related to the target of the query (ftp.isc.org) and that the answer received has passed the validation process described in How Are Answers Verified?. We can have confidence in the authenticity and integrity of the answer, that ftp.isc.org really points to the IP address 149.20.1.49, and that it wa</span></font><span style="font-size: 11px; font-family: Menlo;">s not a spoofed answer from a clever attacker.</span></p><p style="margin: 0px; font-stretch: normal; line-height: normal;"><font face="Menlo"><span style="font-size: 11px;"><br></span></font></p><p style="margin: 0px; font-stretch: normal; line-height: normal;"><font face="Menlo"><span style="font-size: 11px;"><br></span></font></p><a href="https://bind9.readthedocs.io/en/v9_18_9/dnssec-guide.html#using-dig-to-verify">https://bind9.readthedocs.io/en/v9_18_9/dnssec-guide.html#using-dig-to-verify</a><div style="display: block;"><br></div><div style="display: block;">My “flags” line does not show the “ad” flag as this is just a set of private servers on a local lan. I can’t submit the DNSSEC details upstream as described here:</div><div style="display: block;"><br></div><div style="display: block;"><a href="https://bind9.readthedocs.io/en/v9_18_9/dnssec-guide.html#uploading-information-to-the-parent-zone">https://bind9.readthedocs.io/en/v9_18_9/dnssec-guide.html#uploading-information-to-the-parent-zone</a><br></div><p style="margin: 0px; font-stretch: normal; line-height: normal;"><font face="Menlo"><span style="font-size: 11px;"></span></font></p><div><div><br><blockquote type="cite"><div>On Dec 15, 2022, at 12:05 PM, adrien sipasseuth <sipasseuth.adrien@gmail.com> wrote:</div><br class="Apple-interchange-newline"><div><div dir="ltr"><div>Hi,</div><div><br></div><div>Ok, I got confused, no need for the keys on the slavs actually.<br><br>On the other hand, my slaves should generate the .signed, .signed.jnl and .jbk files of my zones, no? currently it is not my case, should I copy them from the master?<br><br>moreover, when I test a "dig A" I don't have the associated RRSIG when I do my "dig A" on a slave while on the master I do.<br><br></div><div>Regards,</div><div>Adrien<br></div></div><br></div></blockquote></div><br></div></div></body></html>