<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Benoit,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I'm a little late to the party on this discussion, but I wrote the following article a few years ago which explains how to setup DNSSEC ,including zone signing, on BIND 9.19:</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<a href="https://www.talkdns.com/articles/a-beginners-guide-to-dnssec-with-bind-9/">https://www.talkdns.com/articles/a-beginners-guide-to-dnssec-with-bind-9/</a></div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I haven't revalidated this against BIND 9.20 but it might help you work out what's going on in your setup. It also explains where the key files are stored.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Best,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Richard.</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> bind-users <bind-users-bounces@lists.isc.org> on behalf of Benoît Panizzon <benoit.panizzon@imp.ch><br>
<b>Sent:</b> 17 April 2026 13:04<br>
<b>To:</b> Peter Davies <peterd@isc.org><br>
<b>Cc:</b> bind-users@lists.isc.org <bind-users@lists.isc.org><br>
<b>Subject:</b> Re: Bind 9.20 inline signing - not signing whole file, only dynamic updated entries.</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Hi Peter<br>
<br>
> Run from the primary what do the following commands return<br>
> dig @127.0.0.1 example.com +dnssec<br>
> dig @127.0.0.1 example.com soa +dnssec<br>
<br>
No dnssec related entries.<br>
<br>
I revisited <a href="https://kb.isc.org/docs/dnssec-key-and-signing-policy">https://kb.isc.org/docs/dnssec-key-and-signing-policy</a> and<br>
probably got confused by the statement, that only adding:<br>
<br>
dnssec-policy default;<br>
<br>
Would get a unsigned zone signed. Hey wait! No dnssec-keygen<br>
to create the keys?<br>
<br>
The default policy specifies what kind of keys to use etc. So maybe I<br>
got too far and created keys which were not necessary? Would they be<br>
created on the fly by what is specified in the policy?<br>
<br>
So I went ahead, started over and deleted the keys I had manually<br>
created with dnssec-keygen for that zone in /etc/bind/keys which<br>
worked for dynamic updates.<br>
<br>
froze / sync -clean zonefile, delete .signed files.<br>
<br>
Incremented serial in the plain unsigned file.<br>
<br>
rndc reconfig<br>
rndc thaw zone<br>
<br>
(unsigned): loaded serial 2007126014<br>
(signed): could not get zone keys for secure dynamic update<br>
(signed): serial 2007126014 (unsigned 2007126014)<br>
(signed): sending notifies (serial 2007126014)<br>
<br>
Oh well, it needs the key files - at least for dynamic updates to work.<br>
But why is it telling (signed)? Were the keys autocreated? Where?<br>
<br>
Can't find them in /etc/bind/keys nor in the debian /var/cache/bind<br>
directory where the zonefiles reside.<br>
<br>
rndc signing -list still states "No signing records found"<br>
<br>
I guess I'm missing some small crucial detail.<br>
<br>
-- <br>
Mit freundlichen Grüssen<br>
<br>
-Benoît Panizzon- @ HomeOffice und normal erreichbar<br>
-- <br>
I m p r o W a r e A G - Leiter Commerce Kunden<br>
______________________________________________________<br>
<br>
Zurlindenstrasse 29 Tel +41 61 826 93 00<br>
CH-4133 Pratteln Fax +41 61 826 93 01<br>
Schweiz Web <a href="http://www.imp.ch">http://www.imp.ch</a><br>
______________________________________________________<br>
-- <br>
Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list.<br>
</div>
</span></font></div>
</body>
</html>