<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>I am turning to collective knowledge because I am facing a
problem.</p>
<p>Until now, I had Debian 12 with 9.18 running using DNSsec, but
for some reason, which I still cannot identify, it has stopped
working.</p>
<p><br>
</p>
<p>Every time I (re)enable</p>
<p><br>
</p>
<p> <font face="monospace" size="2">inline-signing yes;</font></p>
<p><font face="monospace" size="2"> dnssec-policy “ecdsa”;</font></p>
<p><br>
</p>
<p>in the zone, it stops loading and throws a SERVFAIL error.</p>
<p><br>
</p>
<p>named.conf.options has</p>
<p><br>
</p>
<p><font face="monospace" size="2">dnssec-policy “ecdsa” {</font></p>
<p><font face="monospace" size="2"> keys {</font></p>
<p><font face="monospace" size="2"> ksk lifetime unlimited algorithm
ECDSAP256SHA256;</font></p>
<p><font face="monospace" size="2"> zsk lifetime 90d algorithm
ECDSAP256SHA256;</font></p>
<p><font face="monospace" size="2"> };</font></p>
<p><font face="monospace" size="2">};</font></p>
<p><br>
</p>
<p>I wrote this little script to delete old logs, but even after
waiting a couple of minutes, the SERVFAIL is still there</p>
<p><br>
</p>
<p><font face="Liberation Mono" size="2">ZONE="DOMAIN"</font></p>
<p><font face="Liberation Mono" size="2">ZONE_FILE="/var/cache/bind/db.$ZONE"</font></p>
<p><font face="Liberation Mono" size="2"><br>
</font></p>
<p><font face="Liberation Mono" size="2">if [ ! -f “$ZONE_FILE” ];
then</font></p>
<p><font face="Liberation Mono" size="2"> echo “ERROR: $ZONE_FILE
not found”</font></p>
<p><font face="Liberation Mono" size="2"> exit 1</font></p>
<p><font face="Liberation Mono" size="2">fi</font></p>
<p><font face="Liberation Mono" size="2">systemctl stop bind9 || {
echo “ERROR: Could not stop BIND”; exit 1; }</font></p>
<p><font face="Liberation Mono" size="2">rm -f “$ZONE_FILE”.jnl
“$ZONE_FILE”.jbk “$ZONE_FILE”.mvd</font></p>
<p><font face="Liberation Mono" size="2">chown bind:bind
“$ZONE_FILE”</font></p>
<p><font face="Liberation Mono" size="2">chmod 644 “$ZONE_FILE”</font></p>
<p><font face="Liberation Mono" size="2">named-checkzone “$ZONE”
“/etc/bind/zonas/db.$ZONE” || { echo “ERROR: named-checkzone
failed”; exit 1; }</font></p>
<p><font face="Liberation Mono" size="2">systemctl start bind9 || {
echo “ERROR: Could not start BIND”; exit 1; }</font></p>
<p><font face="Liberation Mono" size="2">sleep 5</font></p>
<p><font face="Liberation Mono" size="2">dig @“127.0.0.1” “$ZONE”
SOA +norecurse | grep -E “status:|aa” || echo “ATTENTION: Check
the BIND logs for SERVFAIL”</font></p>
<p><br>
</p>
<p>Any clue would be much appreciated.</p>
</body>
</html>