<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi Björn.</p>
<p>Not sure if my (late) reply is any use to you, but yes my
understanding is that you could use localhost as the parental
agent in the cases where (a) the local machine also hosts the
parent zone, or (b) it is a recursive resolver. In the latter case
the DNSSEC responses would be validated (assuming of course that
the local resolver does DNSSEC validation).</p>
<p>As I understand there are two schools of thought for configuring
parental-agents:</p>
<ol>
<li>You could explicitly specify all of the parent zone name
servers. In that case all the servers are queried and the KSK
rollover proceeds once all servers are publishing the new DS
record.</li>
<li>You could specify a validating recursive resolver. In that
case only one authoritative name server will be queried (you
won't know which) and the recursive resolver validates the
response, and the KSK rollover proceeds if that server is
publishing the new DS record.<br>
</li>
</ol>
<p>I suppose the theoretical risk with #1 is that because the
responses from the authoritative servers aren't validated, it
would be possible for a MITM to trick BIND into thinking that the
new DS records had been published before they actually had, which
could lead to a situation where you complete the KSK roll-over
early and invalidate your zone?<br>
</p>
<p>Also please note that BIND 9.19 introduces a new option:</p>
<dl>
<dt class="sig sig-object namedconf"
id="namedconf-statement-checkds">
<i><b><span class="sig-name descname"><span class="pre">checkds</span></span></b></i></dt>
</dl>
<dl>
<dd>
<p><strong>Grammar: </strong><code class="docutils literal
notranslate"><span class="pre">checkds</span> <span
class="pre">(</span> <span class="pre">explicit</span> <span
class="pre">|</span> <span class="pre"><boolean></span>
<span class="pre">);</span></code></p>
<p><strong>Blocks: </strong>zone (primary, secondary)</p>
<p><strong>Tags: </strong>dnssec</p>
<p>Controls whether <code class="docutils literal notranslate"><span
class="pre">DS</span></code> queries are sent to parental
agents.</p>
<p>If set to <code class="docutils literal notranslate"><span
class="pre">yes</span></code>, DS queries are sent when a
KSK rollover is in progress.
The queries are sent to the servers listed in the parent
zone’s NS records.
This is the default if there are no <a class="reference
internal"
href="https://bind9.readthedocs.io/en/latest/reference.html#namedconf-statement-parental-agents"
title="namedconf-statement-parental-agents"><code
class="xref any namedconf namedconf-ref docutils literal
notranslate"><span class="pre">parental-agents</span></code></a>
configured for
the zone.</p>
<p>If set to <code class="docutils literal notranslate"><span
class="pre">explicit</span></code>, DS queries are sent
only to servers explicitly listed
using <a class="reference internal"
href="https://bind9.readthedocs.io/en/latest/reference.html#namedconf-statement-parental-agents"
title="namedconf-statement-parental-agents"><code
class="xref any namedconf namedconf-ref docutils literal
notranslate"><span class="pre">parental-agents</span></code></a>.
This is the default if there are parental
agents configured.</p>
<p>If set to <code class="docutils literal notranslate"><span
class="pre">no</span></code>, no DS queries are sent.
Users should manually run
<a class="reference internal"
href="https://bind9.readthedocs.io/en/latest/manpages.html#cmdoption-rndc-arg-dnssec"><code
class="xref std std-option docutils literal notranslate"><span
class="pre">rndc</span> <span class="pre">dnssec</span>
<span class="pre">-checkds</span></code></a> with the
appropriate parameters
to signal that specific DS records are published and/or
withdrawn.</p>
</dd>
</dl>
<p></p>
<p>Nick.<br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 11/09/23 23:52, Björn Persson wrote:<br>
</div>
<blockquote type="cite"
cite="mid:20230911135235.36060453@tag.xn--rombobjrn-67a.se">
<pre class="moz-quote-pre" wrap="">Hello, I'm trying to configure automatic KSK (or CSK) rollover. I'm
confused about how to poll securely for DS records.
Section 5.1.2.1 of the BIND 9 Administrator Reference Manual says:
| [parental-agents] needs to be a trusted server, because BIND does not
| validate the response.
and section 8.2.26.1 says:
| The DS response is not validated so it is recommended to set up a
| trust relationship with the parental agent. For example, use TSIG to
| authenticate the parental agent, or point to a validating resolver.
I don't think the registry wants to exchange TSIG keys with every
domain holder. A validating resolver seems much more achievable. My
master server is also the validating resolver of its host. Can I set
parental-agents to localhost to make BIND ask itself to validate the DS
response? Or would it still do the lookup in the same non-validating
way? Or would it enter infinite recursion? Must the validating resolver
be a different name server from the master server that performs the key
rollover?
Björn Persson
</pre>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
</blockquote>
</body>
</html>