<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<p>I use an unsigned hidden master I maintain from inside my local network. This feeds a secondary server where the signing is done and it acts as a master to other secondaries. Works well. Started as an experiment and works well enough I've left it alone.</p>
<p> Hidden master >> DNSSEC signing server (slave to hidden, master to secondariers) >> secondaries</p>
<p>Here's a config block</p>
<p>zone example.com {<br /> type slave;<br /> masters { a.b.c.d key master-dns01; };<br /> file "slave/example.com.db";<br /> key-directory "keys/example.com";<br /> dnssec-policy domain-policy;<br /> inline-signing yes;<br /> zone-statistics yes;<br />};</p>
<p><br /></p>
<p>If you're interested in more specifics, I'm happy to share. Ping me off-list</p>
<p>Eric</p>
<p><br /></p>
<p id="reply-intro">On 2023-01-21 19:56, Randy Bush wrote:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">hi mark<br /><br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">hidden primary can not sign. can the public primary which fetches<br />from it, and happens to be primary for the parent zone, do bitw<br />signing?</blockquote>
<br />In-line signing is the concept you are looking for and yes named<br />supports it.</blockquote>
<br />i know bind9 does bitw. happy to learn it is called inline-signing.<br /><br />sorry not to have been clear. i want to sign a zone where the server is<br />secondary. i.e. may i use<br /><br /> zone "foo.bar" {<br /> type slave;<br /> file "secondary/bar.foo"; // yes, i like dir list to alpha sort<br /> ...<br /> auto-dnssec maintain;<br /> inline-signing yes;<br /> }<br /> <br />looking at example 2 in <a href="https://kb.isc.org/docs/aa-00626" target="_blank" rel="noopener noreferrer">https://kb.isc.org/docs/aa-00626</a>, i think that<br />this will work, i.e. there will be a `secondary/bar.foo.signed` from<br />which i can extract the DS needed by the parent zone, the server will<br />send notifies etc.<br /><br />randy</div>
</blockquote>
</body></html>