<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">Well, you didn’t say which version of ARM did you follow. Your ARM needs to match the BIND 9 version - you need to ask RH for the matching ARM.<div><br></div><div>And of course, if you find discrepancies between the BIND 9 version as provided by ISC and matching ARM as provided by ISC, we would be happy to fix it.</div><div><br></div><div>And I need to mention that ISC provides packages for RHEL and generally recommends that user use latest upstream version of the BIND 9.<br><br>Ondřej<br><div dir="ltr"><div>--</div>Ondřej Surý — ISC (He/Him)<div><br></div><div>My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.</div></div><div dir="ltr"><br><blockquote type="cite">On 24. 7. 2023, at 20:15, E R <fasteddieinaustin@gmail.com> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><div dir="ltr">As if DNSSec is not confusing enough...It seems the ARM manual that matches my release is out of step with the web site. I followed the "Easy-Start Guide for Signing Authoritative Zones" in the ARM manual after manually signing my test zone for my starting point. The ARM says you ONLY need to specify "dnssec-policy default;" in your zone, view or options clause for the newer way to sign things. I completed the steps successfully (except for one command that no longer works as shown in the manual which is not important). I cannot find anything broken with BIND 9.16.23-RH (Extended Support Version) when I follow the ARM manual.<div><br></div><div>This document <a href="https://kb.isc.org/docs/dnssec-key-and-signing-policy">https://kb.isc.org/docs/dnssec-key-and-signing-policy</a> says I need to have dynamic zone for things to work. Don't need or design anything other than a good ole static zone since an entry is changed like 3-4 times per year. The newest ARM has a new section that mentions needing to setup Dynamic DNS but it also states that BIND previously used implicit inline-signing. It is really difficult for a casual observer to sort this out. No reference to what they mean by "previously". </div><div><br></div><div>Did they break builds newer than 9.16.23 and that is why I am not seeing any issues? Or is it the fact that I am not an DNSSEC expert I am not seeing a glaring issue?</div></div>
<span>-- </span><br><span>Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list</span><br><span></span><br><span>ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.</span><br><span></span><br><span></span><br><span>bind-users mailing list</span><br><span>bind-users@lists.isc.org</span><br><span>https://lists.isc.org/mailman/listinfo/bind-users</span><br></div></blockquote></div></body></html>