<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div dir="ltr">
<div style=""></div>
<div style="">
<div>
<div dir="ltr">
<div dir="ltr">Hi Daniel, </div>
<div dir="ltr"><br>
</div>
<div dir="ltr">As far as from my experience, you’ll need to create a KSK and a ZSK first. But you can also use script to generate these key pairs. However, it is (at least with the few registrars I have experience) mandatory to enter your first DS record manually,
and then you could use CDS (if they support querying CDS) for new keys. <span id="ms-outlook-ios-cursor"></span></div>
<div dir="ltr"><br>
</div>
<div dir="ltr">A quick shell syntax for creating key pairs might be:</div>
<div dir="ltr">```bash</div>
<div dir="ltr"><span style="font-size: 12pt; line-height: normal;"># domain=example.com</span></div>
<div dir="ltr"><span style="font-size: 12pt; line-height: normal;"># root_keydir=/var/named/keys # use whatever you want as long as named has proper permission to access</span></div>
<div dir="ltr"><span style="font-size: 12pt; line-height: normal;"># create key directory</span></div>
<div dir="ltr"><span style="font-size: 12pt; line-height: normal;">mkdir -p "${root_keydir}/${domain}" && cd </span><span style="background-color: rgb(255, 255, 255); text-decoration: none; font-size: 12pt; line-height: normal; display: inline !important;">"${root_keydir}/${domain}"</span><span style="background-color: rgb(255, 255, 255); text-decoration: none; display: inline !important;"><span class="Apple-converted-space" style="font-size: 12pt; line-height: normal;"> </span></span></div>
<div dir="ltr"><span style="background-color: rgb(255, 255, 255); text-decoration: none; display: inline !important;"><span class="Apple-converted-space" style="font-size: 12pt; line-height: normal;"># KSK</span></span></div>
<div dir="ltr"><span style="background-color: rgb(255, 255, 255); text-decoration: none; display: inline !important;"><span class="Apple-converted-space" style="font-size: 12pt; line-height: normal;">dnssec-keygen -a <key_algorithm> -b <keysize> -f KSK $domain</span></span></div>
<div dir="ltr"><span style="background-color: rgb(255, 255, 255); text-decoration: none; display: inline !important;"><span class="Apple-converted-space" style="font-size: 12pt; line-height: normal;">dnssec-keygen-a <key_algorithm> -b <keysize> $domain</span></span></div>
<div dir="ltr"><span style="background-color: rgb(255, 255, 255); text-decoration: none; display: inline !important;"><span class="Apple-converted-space" style="font-size: 12pt; line-height: normal;"># what I usually do also (to correct ownership), don't use
this kind of wildcard if you keep everything in one dir:</span></span></div>
<div dir="ltr"><span style="background-color: rgb(255, 255, 255); text-decoration: none; display: inline !important;"><span class="Apple-converted-space" style="font-size: 12pt; line-height: normal;">crown named:named ./K*</span></span></div>
<div dir="ltr"><span style="background-color: rgb(255, 255, 255); text-decoration: none; display: inline !important;"><span class="Apple-converted-space" style="font-size: 12pt; line-height: normal;"># if not already done add config to your config file, with
<code>key-directory</code> specified</span></span></div>
<div dir="ltr"><span style="background-color: rgb(255, 255, 255); text-decoration: none; display: inline !important;"><span class="Apple-converted-space" style="font-size: 12pt; line-height: normal;"># you can also store the DS record to file or send them via
API but to retrieve them</span></span></div>
<div dir="ltr"><span style="font-size: inherit;">dnssec-dsfromkey <your_newly_created_key_file></span></div>
<div dir="ltr"><span style="font-size: inherit;">```</span></div>
</div>
</div>
<div id="ms-outlook-mobile-signature">
<div><br>
</div>
<div dir="ltr">
<div style="direction:ltr" dir="auto">Met vriendelijke groet / Best regards, </div>
<div style="direction:ltr" dir="auto">Jiaming Zhang</div>
<div style="direction:ltr" dir="ltr"><br>
</div>
<div style="direction:ltr" dir="auto"><b>Yixi Meta</b></div>
<div style="direction:ltr;font-size:14px" dir="auto"><b>Email: J.Zhang@yiximeta.com</b></div>
<div style="direction:ltr;font-size:14px" dir="auto"><b>Website: yiximeta.com
<div dir="auto" style="font-weight: 400; font-family: Calibri, Arial, Helvetica, sans-serif; margin: 0px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<b>
<div dir="ltr" style="font-size: 16px; font-weight: 400; margin: 0px; background-color: rgb(255, 255, 255);">
<span dir="auto" style="font-size: 13px; margin: 0px; background-color: rgb(255, 255, 255);"><b><br>
</b></span></div>
<span dir="ltr" style="font-size: 16px; font-weight: 400; margin: 0px; background-color: rgb(255, 255, 255);"><span dir="auto" style="font-size: 13px; margin: 0px; background-color: rgb(255, 255, 255);"><i><b style="font-style:normal"><span dir="ltr" style="font-size: 16px; font-weight: 400; margin: 0px; background-color: rgb(255, 255, 255);"><span dir="auto" style="font-size: 8pt; margin: 0px; background-color: rgb(255, 255, 255);"><i><b style="font-style:normal;font-size:14px"><span dir="ltr" style="font-size: 16px; font-weight: 400; margin: 0px; background-color: rgb(255, 255, 255);"><span dir="auto" style="font-size: 13px; margin: 0px; background-color: rgb(255, 255, 255);"><i><b style="font-style:normal"><span dir="ltr" style="font-size: 16px; font-weight: 400; margin: 0px; background-color: rgb(255, 255, 255);"><span dir="auto" style="font-family: Arial, Helvetica, sans-serif; font-size: 8pt; margin: 0px; background-color: rgb(255, 255, 255);"><i>De
informatie in dit bericht is uitsluitend bestemd voor de geadresseerde. Aan dit bericht en de bijlagen kunnen geen rechten worden ontleend. Heeft u deze e-mail onbedoeld ontvangen? Dan verzoeken wij u het te vernietigen en de afzender te informeren. Openbaar
maken, kopiëren en verspreiden van deze e-mail of informatie uit deze e-mail is alleen toegestaan met voorafgaande schriftelijke toestemming van de afzender. Het Yixi Meta staat geregistreerd bij de Kamer van Koophandel in het handelsregister onder nummer
85744115.</i></span></span></b></i></span></span></b></i></span></span></b></i></span></span></b></div>
<span dir="ltr" style="font-weight: 400; font-family: Calibri, Arial, Helvetica, sans-serif; margin: 0px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><b><span dir="ltr" style="font-size: 16px; font-weight: 400; margin: 0px; background-color: rgb(255, 255, 255);"><span dir="auto" style="font-size: 13px; margin: 0px; background-color: rgb(255, 255, 255);"><i><b style="font-style:normal"><span dir="ltr" style="font-size: 16px; font-weight: 400; margin: 0px; background-color: rgb(255, 255, 255);"><span dir="auto" style="font-size: 8pt; margin: 0px; background-color: rgb(255, 255, 255);"><i><br>
</i></span></span></b></i></span></span></b></span><span dir="auto" style="font-weight: 400; font-family: Calibri, Arial, Helvetica, sans-serif; margin: 0px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><b><span dir="ltr" style="font-size: 16px; font-weight: 400; margin: 0px; background-color: rgb(255, 255, 255);"><span dir="auto" style="font-size: 13px; margin: 0px; background-color: rgb(255, 255, 255);"><i><b style="font-style:normal"><span dir="ltr" style="font-size: 16px; font-weight: 400; margin: 0px; background-color: rgb(255, 255, 255);"><span dir="auto" style="font-family: Arial, Helvetica, sans-serif; font-size: 8pt; margin: 0px; background-color: rgb(255, 255, 255);"><i>The
content of this message is intended solely for the addressee. No rights can be derived from this message or its attachments. If you are not the intended recipient, we kindly request you to delete the message and inform the sender. It is strictly prohibited
to disclose, copy or distribute this email or the information inside it, without a written consent from the sender. Yixi Meta is registered with the Dutch Chamber of Commerce trade register with number 85744115.</i></span></span></b></i></span></span></b></span></b></div>
</div>
</div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>Van:</b> bind-users <bind-users-bounces@lists.isc.org> namens Daniel A. Rodriguez via bind-users <bind-users@lists.isc.org><br>
<b>Verzonden:</b> Thursday, June 22, 2023 7:47:55 PM<br>
<b>Aan:</b> bind-users@lists.isc.org <bind-users@lists.isc.org><br>
<b>Onderwerp:</b> DNSSEC doubt</font>
<div> </div>
</div>
<div>
<div dir="auto">I wonder if it's mandatory make a manual deployment prior to an automated setup.</div>
</div>
</body>
</html>