On 02/25/2013 08:15 PM, Mark Andrews wrote:
In message <512c09f5.4040...@htt-consult.com>, Robert Moskowitz writes:
On 02/25/2013 03:25 PM, Robert Moskowitz wrote:
On 02/25/2013 02:33 PM, Robert Moskowitz wrote:
On 02/25/2013 02:00 PM, Casey Deccio wrote:
On Mon, Feb 25, 2013 at 5:09 AM, Robert Moskowitz
<r...@htt-consult.com <mailto:r...@htt-consult.com>> wrote:
Yes, I know lots of places don't have DNSSEC signed zones.
**I** have not done mine yet, but I turned on DNSSEC checking
on my server and I am getting all too many messages like:
validating @0xb4247b50: 117.in-addr.arpa NSEC: no valid
signature found: 1 Time(s)
validating @0xb4247b50: 117.in-addr.arpa SOA: no valid
signature found: 1 Time(s)
Yes, but 117.in-addr.arpa *is* signed [1], so if you're not getting
signatures, that's problematic.
So that is not good. This is over port 53, right? I have that open
for udp and tcp. My general options section has:
dnssec-enable yes;
dnssec-validation yes;
digging back in the archive here, I find out this should be
dnssec-validation auto;
Actually it can be either. It's all a matter of how you want to
setup your trust anchors. For private root zones it is absolutely
the wrong thing to do.
I got this from some old messages from you on the subject of "no valid
signature".
Perhaps tieing into my using the builtin root hints rather than
explicitly including a root.hint stub?
Like the other person, once I changed from 'yes' to 'auto' I stopped
logging these messages so I ASSuME that now all those zones are being
validated.
No private root zones here. At least that I know of!
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
