DNSSEC

DNSSEC signs DNS data so a validating resolver can prove an answer is genuine and unmodified. This sheet covers signing a zone with BIND (dnssec-policy with inline signing, or manual dnssec-keygen and dnssec-signzone), publishing the DS record, and checking and troubleshooting with dig and delv.

Documentation: BIND 9 DNSSEC Guide · BIND 9 manual pages Project: BIND 9 at ISC

Verification: BIND tools and rndc output checked against BIND 9.18.39 (Ubuntu 24.04 package) in a throwaway container, including a signed example.com test zone. Other versions may differ. Not exercised (taken from --help output only, unverified): rndc dnssec -checkds with -key/-when, rndc dnssec -rollover, rndc nta, rndc loadkeys, rndc sign, dnssec-cds, and delv -a with a custom anchor file.

Concepts #

Sign a Zone with dnssec-policy #

The recommended method on BIND 9.16 and later (checked on 9.18): BIND generates and rolls keys and re-signs the zone itself. Use inline-signing yes to keep the unsigned zone file as it is.

options {
    directory "/var/cache/bind";
    key-directory "/var/cache/bind/keys";
    recursion no;
};

dnssec-policy "homelab" {
    keys {
        ksk lifetime unlimited algorithm ecdsap256sha256;
        zsk lifetime 60d algorithm ecdsap256sha256;
    };
    dnskey-ttl 300;
    signatures-validity 14d;
    nsec3param iterations 0 optout no salt-length 0;
};

zone "example.com" {
    type primary;
    file "zones/example.com.db";
    dnssec-policy "homelab";
    inline-signing yes;
};

The signed copy of an inline-signed zone is stored as <ZONEFILE>.signed in a raw binary format, not text. Zone-file tools such as dnssec-dsfromkey -f cannot read it, so get the DS from a dig query as above.

Sign a Zone Manually #

Offline signing with the key tools. You re-sign before the signatures expire (default validity is 30 days) and bump the SOA serial each time.

cd /etc/bind/zones
dnssec-keygen -a ECDSAP256SHA256 -n ZONE -f KSK example.com
dnssec-keygen -a ECDSAP256SHA256 -n ZONE example.com
dnssec-signzone -S -o example.com -N unixtime -x example.com.db
named-checkzone -i full example.com example.com.db.signed

The two dnssec-keygen runs print the key names (Kexample.com.+013+<KEYTAG>). With -S (smart signing) dnssec-signzone finds the key files itself and also writes dsset-example.com. containing the DS records. Point the zone statement at example.com.db.signed. Keep K*.private files secret and backed up.

DS Records #

The DS record goes in the parent zone, so you add it at your registrar (or in the parent zone if you run it). Use SHA-256 (digest type 2).

A DS has four fields: key tag, algorithm number (13 is ECDSAP256SHA256), digest type (2 is SHA-256) and the digest. Registrars may ask for the DNSKEY itself instead; use dig <ZONE> DNSKEY +short and pick the 257 (KSK) line.

rndc for DNSSEC #

Validating Resolver #

A BIND resolver validates by default with the built-in root trust anchor.

options {
    recursion yes;
    dnssec-validation auto;
};

dig #

dig does not validate by itself: it relays what the resolver says. See dig for general use.

Compare the two:

dig app.example.com @RESOLVER_IP
dig +cd app.example.com @RESOLVER_IP

SERVFAIL on the first and NOERROR on the second means validation is failing and the data itself is reachable.

delv #

delv (from bind9-dnsutils) does its own validation and reports why it succeeded or failed, independent of your resolver.

Troubleshooting #

See Also #

• BIND 9
• dig
• DNS Record Types
• DNS Troubleshooting
• Unbound
• DNS Encryption