<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body dir="auto">Hi Carsten.<div dir="auto"><br></div><div dir="auto">I've been running split views with a DNSSEC zone using dnssec-policy for at least a couple of years.</div><div dir="auto"><br></div><div dir="auto">I'm using a CSK (i.e. combined KSK+ZSK) and haven't yet worked out the best way to automate key rollover wrt DS in parent zone, so my key rollovers are manual currently. Consequently I've only done a key rollover a couple of time in that period.</div><div dir="auto"><br></div><div dir="auto">But this setup has been working fine for me the whole time.</div><div dir="auto"><br></div><div dir="auto">Nick.</div><div><br></div><div align="left" dir="auto" style="font-size:100%;color:#000000"><div>-------- Original message --------</div><div>From: Matthijs Mekking <matthijs@isc.org> </div><div>Date: 18/03/23 3:43 AM (GMT+12:00) </div><div>To: bind-users@lists.isc.org </div><div>Subject: Re: KASP: sharing policy and keys between views </div><div><br></div></div>Hi Carsten,<br><br>We did have some bugs in the past when it comes to sharing keys with <br>dnssec-policy among different views. But the last one is from a year ago <br>(fixed in 9.16.19).<br><br>So while I don't have experience myself with a similar setup, we did <br>have some bug reports that used dnssec-policy and views that have been <br>resolved and it has been quiet when it comes to "dnssec-policy with <br>views" related bug reports.<br><br>Now that doesn't mean there are none, but hopefully adds a bit of <br>confidence.<br><br>Best regards,<br> Matthijs<br><br><br>On 3/17/23 11:46, Carsten Strotmann via bind-users wrote:<br>> Hi,<br>> <br>> (please do not start a discussion on the usefulness of views. I'm not<br>> in favor of views, but sometimes I have to work with them).<br>> <br>> I have a client that runs a split horizon (internal / external view<br>> of the same domain namespace) setup with BIND 9 on Linux.<br>> <br>> Both the internal and external views of the domain are DNSSEC<br>> signed.<br>> <br>> In the past, the setup was using "auto-dnssec maintain;" on a common,<br>> shared key directory with manually created keys. Both zones in both<br>> views fetched the keys and did the signing. This setup was stable and<br>> working fine.<br>> <br>> Because "auto-dnssec maintain;" is deprecated, we're evaluating to<br>> change the setup to use a shared DNSSEC KASP definition, pointing to<br>> the same key directory (using shared keys and a shared state file).<br>> <br>> The test setup runs without issues for one month now and has<br>> successfully done 3 ZSK rollovers in the time (KSK rollovers are<br>> manual). So it *seems* like a working configuration. We have not seen<br>> errors or race-conditions (but we might have been lucky).<br>> <br>> Does anyone here has experience with a similar setup, or deeper<br>> insight into the code and can tell me if this is a possible solution<br>> to operate a DNSSEC signed split horizon setup?<br>> <br>> Greetings<br>> <br>> Carsten Strotmann<br>> <br>> <br>-- <br>Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list<br><br>ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.<br><br><br>bind-users mailing list<br>bind-users@lists.isc.org<br>https://lists.isc.org/mailman/listinfo/bind-users<br></body></html>