<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Thank you for the detailed explanation! This is what I was wondering.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">All the dnssec configuration(s) only need to reside on the master then, correct?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Looks like it a got a little clean-up to do.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Appreciate everyones insight with this!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">~Jordan<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="display:none"><o:p> </o:p></span></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="500" style="width:375.0pt">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in"></td>
</tr>
</tbody>
</table>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">On 2/9/24, 8:44 AM, "Björn Persson" <Bjorn@xn--rombobjrn-67a.se> wrote:<o:p></o:p></p>
<div>
<p class="MsoNormal">Jordan Larson via bind-users wrote:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">> Was I wrong to enable “inline-signing yes” for my slave zones? I would assume each slave would need its own DS key? Can I do that?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">That sounds very wrong. Your zone shall have one DNSsec key, or set of<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">keys, that is the same on all slave servers. A client shall see the<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">same set of DNSKEY records regardless of which DNS server it queries.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If you sign the zone on the master, then you shouldn't sign it again on<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">the slaves. The slaves shall receive RRSIG records from the master just<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">like any other records, and serve them to clients. Only the master has<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">the secret keys.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If the master can't sign for some reason, then you can do "bump in the<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">wire" signing: A single signing server receives the unsigned zone from<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">the hidden master over a secure link, signs it, and distributes the<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">signed zone to multiple slaves. Only the signing server has the secret<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">keys. That way there's still a single consistent set of DNSKEY records.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If you need to give different answers to different clients, then you<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">configure separate views, and you must ensure that each client sees the<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">same view – including the same keys – on all DNS servers it can query.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Björn Persson<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>