[dns-operations] signing a zone with NSEC3 records.
Ed.Lewis at neustar.biz
Thu Sep 10 19:52:53 UTC 2009
(Resending because the quote level indicators went missing.)
At 12:07 -0700 9/10/09, Ravi Kondamuru wrote:
># 5. sign the zone with both the keys and opt for NSEC3 by using option -3:
>does not generate a signed domain.
># indicates error: NSEC3 generation requested with NSEC only DNSKEY
>fbsd63# dnssec-signzone -o <http://testnsecnsec3.org>testnsecnsec3.org
>-k Ktestnsecnsec3.org.+007+19293.private -3
>dnssec-signzone: NSEC3 generation requested with NSEC only DNSKEY
The problem is you can't NSEC3 with a NSEC-only key, but you can NSEC
with an NSEC3-capable key.
I made the same mistake when I tried this the first time.
>Am I doing something wrong in step 5 or is it not possible to do (5)?
>With step 4, I got a signed domain inline with what you have attached in
So - alg 5 and/or 7 can be in a NSEC zone
Only alg 7 can be in a NSEC3 zone
The reason is that if a validator only knows alg 5, it probably
doesn't understand NSEC3 so it would have issues.
If a validator knows alg 7, it knows NSEC (from the old days) and
NSEC3 (the new thing).
NeuStar You can leave a voice message at +1-571-434-5468
As with IPv6, the problem with the deployment of frictionless surfaces is
that they're not getting traction.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the dns-operations