I am planning to sign multiple DNS zones with BIND and have the following questions which I could not answer by reading the latest BIND 9.10 Reference Manual.
How can I use the same ZSK with multiple zones? When generating a new key with
dns-keygen nameseems to offer
nametypecan be one of
ZONE, HOST, ENTITY, USER, OTHER. Can one of them be used to associate the generated ZSK with a set of zones?
Where can I specify what directory the signed zone files (
*.jbk, *.jnl, *.signed, *.signed.jnl) get put into when using
inline-signing yes;? I'd rather have the directory with the original zone files (which get edited manually) rather clean and put the auto-generated files somewhere else.
Since I am not sure whether or not "Stackexchange - Information Security" is also intended to be used for specific implementation questions, please move the question if it doesn't fit here.