Re: DNSSEC and secondary DNS servers

2018-09-12 Thread @lbutlr
On 9 Sep 2018, at 14:58, Mark Elkins wrote: > Umm... this initially looks great but something is seriously strange. The > first numerical value after DS should be the Key ID (or Key Tag). I really > doubt that you would (randomly) create two different DNSKEY records with > sequential Key-ID's (

Re: DNSSEC and secondary DNS servers

2018-09-09 Thread LuKreme
On Sep 8, 2018, at 10:21, Mark Elkins wrote: > Have you DNSSEC Signed your Domain - that is "covisp.net" because I > don't see any DS records for it in the "net" zone. I think I have everything set now and am hopping the two errors I have about validation are a matter of waiting for hover to pro

Re: DNSSEC and secondary DNS servers

2018-09-09 Thread @lbutlr
On 08 Sep 2018, at 10:21, Mark Elkins wrote: > Have you DNSSEC Signed your Domain - that is "covisp.net" because I > don't see any DS records for it in the "net" zone. Not yet, I want to have everything working on my side before I go upstream. Hover is pretty simple to setup the DNSSEC but I nee

Re: DNSSEC and secondary DNS servers

2018-09-09 Thread @lbutlr
On 08 Sep 2018, at 11:46, @lbutlr wrote: > I need to check that I am supposed to generate the digest. to check *HOW* I am supposed to generate the digest. -- Ille Qui Nos Omnes Servabit ___ Please visit https://lists.isc.org/mailman/listinfo/bind-u

Re: DNSSEC and secondary DNS servers

2018-09-08 Thread @lbutlr
On 08 Sep 2018, at 09:59, Niall O'Reilly wrote: > On 8 Sep 2018, at 14:58, @lbutlr wrote: > >> so I think there must be something else. > > You might need to so some other housekeeping: > > https://zonemaster.net/domain_check > http://dnsviz.net/d/covisp.net/dnssec/ Oh, well, that is interesti

Re: DNSSEC and secondary DNS servers

2018-09-08 Thread Mark Elkins
Some clarification Have you DNSSEC Signed your Domain - that is "covisp.net" because I don't see any DS records for it in the "net" zone. dig @a.gtld-servers.net. covisp.net ds flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 returns the SOA for NET - so I know I got to the r

Re: DNSSEC and secondary DNS servers

2018-09-08 Thread Grant Taylor via bind-users
On 09/08/2018 07:58 AM, @lbutlr wrote: what do I need to do for other DNS servers? I don't think you need to do anything special. The zone signatures come form and are managed by the master name server. The secondary name server(s) is (are) just additional servers with copies of the zone.

Re: DNSSEC and secondary DNS servers

2018-09-08 Thread Niall O'Reilly
On 8 Sep 2018, at 14:58, @lbutlr wrote: > so I think there must be something else. You might need to so some other housekeeping: https://zonemaster.net/domain_check http://dnsviz.net/d/covisp.net/dnssec/ /Niall signature.asc Description: OpenPGP digital signature