<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hello, hoping somebody might have some insight into the errors I am seeing on ipv6 dnssec records.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am just starting to roll out dnssec on my reverse zones and have started with IPv6 on the record that contains just our ns2.itctel.com and dns2.itctel.com records. Our IPv4 forward zones are working fine and without error. This is our
first reverse zone. I am currently using the same policy as the forward zone, but if necessary can create a separate policy for the reverse zone.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">When I query <a href="https://dnssec-debugger.verisignlabs.com/3.0.0.0.0.9.0.0.6.d.7.0.6.2.ip6.arpa">
https://dnssec-debugger.verisignlabs.com/3.0.0.0.0.9.0.0.6.d.7.0.6.2.ip6.arpa</a> it looks like the 0.0.6.d.7.0.6.2.ip6.arpa section is having issues with DNSKEY; however, the sections both above and below that section successfully returns green checkmarks.<o:p></o:p></p>
<p class="MsoNormal">Do I need to separate out all of the smaller sections below into their own zones? My full zone of 3.0.0.0.0.9.0.0.6.d.7.0.6.2.ip6.arpa is successful, but the smaller portions are failing.<o:p></o:p></p>
<p class="MsoNormal">I get these successful messages:<o:p></o:p></p>
<p class="MsoNormal"> Found 1 DS records for 0.0.6.d.7.0.6.2.ip6.arpa in the 0.6.2.ip6.arpa zone<o:p></o:p></p>
<p class="MsoNormal"> DS=3283/SHA-256 has algorithm ECDSAP256SHA256<o:p></o:p></p>
<p class="MsoNormal"> Found 1 RRSIGs over DS RRset<o:p></o:p></p>
<p class="MsoNormal"> RRSIG=42693 and DNSKEY=42693 verifies the DS RRset<o:p></o:p></p>
<p class="MsoNormal">Then I see errors at the dnssec-debugger: (in the 0.0.6.d.7.0.6.2.ip6.arpa section)<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">ns2.itctel.com returns REFUSED for 0.0.6.d.7.0.6.2.ip6.arpa/DNSKEY<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">ns1.itctel.com returns REFUSED for 0.0.6.d.7.0.6.2.ip6.arpa/DNSKEY<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">Failed to get DNSKEY RR set for zone 0.0.6.d.7.0.6.2.ip6.arpa<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">ns2.itctel.com returns REFUSED for 9.0.0.6.d.7.0.6.2.ip6.arpa/DNSKEY<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">ns1.itctel.com returns REFUSED for 9.0.0.6.d.7.0.6.2.ip6.arpa/DNSKEY<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">ns1.itctel.com returns REFUSED for 0.9.0.0.6.d.7.0.6.2.ip6.arpa/DNSKEY<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">ns2.itctel.com returns REFUSED for 0.9.0.0.6.d.7.0.6.2.ip6.arpa/DNSKEY<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">ns1.itctel.com returns REFUSED for 0.0.9.0.0.6.d.7.0.6.2.ip6.arpa/DNSKEY<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">ns2.itctel.com returns REFUSED for 0.0.9.0.0.6.d.7.0.6.2.ip6.arpa/DNSKEY<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">ns2.itctel.com returns REFUSED for 0.0.0.9.0.0.6.d.7.0.6.2.ip6.arpa/DNSKEY<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">ns1.itctel.com returns REFUSED for 0.0.0.9.0.0.6.d.7.0.6.2.ip6.arpa/DNSKEY<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">ns2.itctel.com returns REFUSED for 0.0.0.0.9.0.0.6.d.7.0.6.2.ip6.arpa/DNSKEY<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">ns1.itctel.com returns REFUSED for 0.0.0.0.9.0.0.6.d.7.0.6.2.ip6.arpa/DNSKEY<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">No DS records found for 3.0.0.0.0.9.0.0.6.d.7.0.6.2.ip6.arpa in the 0.0.6.d.7.0.6.2.ip6.arpa zone<o:p></o:p></p>
<p class="MsoNormal">Then the next section is a success again<o:p></o:p></p>
<p class="MsoNormal"> Found 2 DNSKEY records for 3.0.0.0.0.9.0.0.6.d.7.0.6.2.ip6.arpa<o:p></o:p></p>
<p class="MsoNormal"> Found 1 RRSIGs over DNSKEY RRset<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">DIG successfully returns without error<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">dig +dnssec 3.0.0.0.0.9.0.0.6.d.7.0.6.2.ip6.arpa DNSKEY @ns1.itctel.com<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in">; <<>> DiG 9.11.9 <<>> +dnssec 3.0.0.0.0.9.0.0.6.d.7.0.6.2.ip6.arpa DNSKEY @ns1.itctel.com<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">;; global options: +cmd<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">;; Got answer:<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33233<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in">;; OPT PSEUDOSECTION:<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">; EDNS: version: 0, flags: do; udp: 1232<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">; COOKIE: 256f28637718668401000000671f8f58815467759394f32c (good)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">;; QUESTION SECTION:<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">;3.0.0.0.0.9.0.0.6.d.7.0.6.2.ip6.arpa. IN DNSKEY<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in">;; ANSWER SECTION:<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">3.0.0.0.0.9.0.0.6.d.7.0.6.2.ip6.arpa. 3600 IN DNSKEY 256 3 13 BCg6PxA7axei2rIO9i7nKcmLR+atxJrNILLYOhxqQjJPHNgB66Llms9G VsHVouZNj2F9FN8r/1yqeGIPaTwwJA==<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">3.0.0.0.0.9.0.0.6.d.7.0.6.2.ip6.arpa. 3600 IN DNSKEY 257 3 13 HuSoT3TZwpQphIZOauDjS72tSNZPLMWho9IhgB05xMiRgtTeMi87n+el 2ZAKkwDMkPvdWMIWEdCp1Vh48CyhwQ==<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">3.0.0.0.0.9.0.0.6.d.7.0.6.2.ip6.arpa. 3600 IN RRSIG DNSKEY 13 16 3600 20241107184719 20241024174719 14995 3.0.0.0.0.9.0.0.6.d.7.0.6.2.ip6.arpa. 0MCAIJnPjB/wvq47z7xcY5xejdNOGIRWFL+TYo+kqK1tU1DcUboUZc3b Bkyeaq5g64DiBgJzHwVZuDUtR/l24A==<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in">;; Query time: 2 msec<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">;; SERVER: 75.102.161.234#53(75.102.161.234)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">;; WHEN: Mon Oct 28 08:19:20 CDT 2024<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">;; MSG SIZE rcvd: 385<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I did register the DS record for this block of IPs that matches the zone with ARIN last week.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Network solutions still does not support AAAA glue records for nameservers, so I am unable to add those.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">My configuration is very simple and pretty much follows the bind documentation.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Running BIND 9.18.30<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">DNSSEC Policy<o:p></o:p></p>
<p class="MsoNormal">dnssec-policy "itc-no-rotate" {<o:p></o:p></p>
<p class="MsoNormal"> keys {<o:p></o:p></p>
<p class="MsoNormal"> ksk key-directory lifetime unlimited algorithm 13;<o:p></o:p></p>
<p class="MsoNormal"> zsk key-directory lifetime unlimited algorithm 13;<o:p></o:p></p>
<p class="MsoNormal"> };<o:p></o:p></p>
<p class="MsoNormal"> nsec3param;<o:p></o:p></p>
<p class="MsoNormal">};<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Zome record for this zone<o:p></o:p></p>
<p class="MsoNormal">zone "3.0.0.0.0.9.0.0.6.d.7.0.6.2.ip6.arpa" in {<o:p></o:p></p>
<p class="MsoNormal"> type master;<o:p></o:p></p>
<p class="MsoNormal"> file "reverse/2607.d600.9000.300.rev";<o:p></o:p></p>
<p class="MsoNormal">dnssec-policy itc-no-rotate;<o:p></o:p></p>
<p class="MsoNormal">inline-signing yes;<o:p></o:p></p>
<p class="MsoNormal">};<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Any idea on what I need to do to resolve this issue?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p style="FONT-SIZE: 10pt; FONT-FAMILY: ARIAL"><strong style="FONT-FAMILY: Calibri"><span style="FONT-SIZE: 10pt; FONT-FAMILY: Calibri"><span style="FONT-FAMILY: Calibri">Michael Martinell</span></span></strong><br style="FONT-FAMILY: Calibri">
<span style="FONT-SIZE: 9pt; FONT-FAMILY: Calibri"><span style="FONT-FAMILY: Calibri">Network/Broadband Technician</span></span><br style="FONT-SIZE: 9pt; FONT-FAMILY: Calibri">
<br style="FONT-FAMILY: Calibri">
<strong style="FONT-FAMILY: Calibri">Interstate Telecommunications Coop., Inc.<br style="FONT-FAMILY: Calibri">
</strong><span style="FONT-SIZE: 8pt; FONT-FAMILY: Calibri">312 4th Street West • Clear Lake, SD 57226</span><br style="FONT-FAMILY: Calibri">
<span style="FONT-SIZE: 8pt; FONT-FAMILY: Calibri">Phone: (605) 874-8313</span><br style="FONT-FAMILY: Calibri">
<span style="FONT-SIZE: 8pt; FONT-FAMILY: Calibri">michael.martinell@itccoop.com</span><br style="FONT-FAMILY: Calibri">
<span style="FONT-SIZE: 8pt; FONT-FAMILY: Calibri">www.itc-web.com</span></p>
</body>
</html>