I am planning to sign multiple DNS zones with BIND and have the following questions which I could not answer by reading the latest BIND 9.10 Reference Manual.

  1. How can I use the same ZSK with multiple zones? When generating a new key with dns-keygen name seems to offer -n nametype where nametype can be one of ZONE, HOST, ENTITY, USER, OTHER. Can one of them be used to associate the generated ZSK with a set of zones?

  2. Where can I specify what directory the signed zone files (*.jbk, *.jnl, *.signed, *.signed.jnl) get put into when using inline-signing yes;? I'd rather have the directory with the original zone files (which get edited manually) rather clean and put the auto-generated files somewhere else.

Since I am not sure whether or not "Stackexchange - Information Security" is also intended to be used for specific implementation questions, please move the question if it doesn't fit here.

1 Answer 1


1 (Same ZSK):

You should not use the same ZSK for multiple zones (as far as I know), as it is a zone signing key. There should be one ZSK for every zone.

2 (Journal Files):

You cannot move the journal files with the current version of bind, however you can make the zone files in the directory bind uses symlinks to files in a cleaner directory.

  • Why shouldn't you sign multiple zones with the same ZSK? Deriving this policy from the name seems a little far-fetched... Aug 12, 2016 at 7:14
  • Especially since OpenDNSSEC seems to be able to do exactly that. Aug 12, 2016 at 12:51
  • Sorry, it appears that it is possible to use the same ZSK for multiple zones (I was under the impression you couldn't). However, it is recommended that you don't: users.isc.org/~jreed/dnssec-guide/…
    – ConnorJC
    Aug 12, 2016 at 19:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .