[dns-operations] signing a zone with NSEC3 records.
Ed.Lewis at neustar.biz
Thu Sep 10 19:39:30 UTC 2009
At 12:07 -0700 9/10/09, Ravi Kondamuru wrote:
# 5. sign the zone with both the keys and opt for NSEC3 by using
option -3: does not generate a signed domain.
# indicates error: NSEC3 generation requested with NSEC only DNSKEY
fbsd63# dnssec-signzone -o
dnssec-signzone: NSEC3 generation requested with NSEC only DNSKEY
The problem is you can't NSEC3 with a NSEC-only key, but you can NSEC
with an NSEC3-capable key.
I made the same mistake when I tried this the first time.
Am I doing something wrong in step 5 or is it not possible to do (5)?
With step 4, I got a signed domain inline with what you have attached
in your email.
So - alg 5 and/or 7 can be in a NSEC zone
Only alg 7 can be in a NSEC3 zone
The reason is that if a validator only knows alg 5, it probably
doesn't understand NSEC3 so it would have issues.
If a validator knows alg 7, it knows NSEC (from the old days) and
NSEC3 (the new thing).
NeuStar You can leave a voice message at +1-571-434-5468
As with IPv6, the problem with the deployment of frictionless surfaces is
that they're not getting traction.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the dns-operations