<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div
style="text-align: left; margin-top: 0.5em; margin-bottom: 0.5em;"><font
face="monospace"><span>Hi Benoît,</span></font></div>
<div
style="text-align: left; margin-top: 0.5em; margin-bottom: 0.5em;"><font
face="monospace"><span> Run from the primary what do the
following commands return </span></font></div>
<div
style="text-align: left; margin-top: 0.5em; margin-bottom: 0.5em;"><font
face="monospace"><span>dig @127.0.0.1 example.com +dnssec </span></font></div>
<div
style="text-align: left; margin-top: 0.5em; margin-bottom: 0.5em;"><font
face="monospace"><span>dig @127.0.0.1 example.com soa +dnssec </span></font></div>
<div
style="text-align: left; margin-top: 0.5em; margin-bottom: 0.5em;"><font
face="monospace"><br>
</font></div>
<div
style="text-align: left; margin-top: 0.5em; margin-bottom: 0.5em;"><font
face="monospace"><span>/Peter</span></font></div>
<p><br>
</p>
<div class="moz-cite-prefix">On 17/04/2026 11.37, Benoît Panizzon
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:20260417113742.7c80daa6@chewbacca.woody.ch">
<pre wrap="" class="moz-quote-pre">Hi Bind gang!
After upgrading to 9.20 I disabled default inline singing to get my
stuff working again.
Now I decided having a shot at inline signing but despite trying to
follow different guides I always get stuck at the same place.
I have an unsigned zone file, keys with correct permissions etc.
zone "example.com" {
type master;
file "example.com";
allow-update {
key update-key;
};
allow-transfer { secondaries; };
dnssec-policy default;
key-directory "/etc/bind/keys";
};
When I issue rndc reconfig after this, I see those lines in the log,
which to me, look good...
(unsigned): loaded serial 2007126012
(signed): serial 2007126013 (unsigned 2007126012)
(signed): sending notifies (serial 2007126013)
example.com.signed
example.com.signed.jnl
were created.
But when I check he zone on the secondaries, it's not signed. Same when
I get the zone by doing a AXFR from the primary - no RRSIG entries.
When I issue rndc signing -list example.com I get
No signing records found
according to the examples, I should get 'done signing'.
I tried: rndc sign example.com to force sign the zone. Nothing changes.
When I add an entry with nsupdate then that one entry is signed and the
SOA also is getting signed as the serial incremented.
What could I be missing?
</pre>
</blockquote>
<pre class="moz-signature" cols="72">--
Peter Davies
Support Engineer
Internet Systems Corporation
<a class="moz-txt-link-abbreviated" href="mailto:peterd@isc.org">peterd@isc.org</a>
001 650-423-1460</pre>
</body>
</html>