I am planning to sign multiple DNS zones with BIND and have the following questions which I could not answer by reading the latest BIND 9.10 Reference Manual.

  1. How can I use the same ZSK with multiple zones? When generating a new key with dns-keygen name seems to offer -n nametype where nametype can be one of ZONE, HOST, ENTITY, USER, OTHER. Can one of them be used to associate the generated ZSK with a set of zones?

  2. Where can I specify what directory the signed zone files (*.jbk, *.jnl, *.signed, *.signed.jnl) get put into when using inline-signing yes;? I'd rather have the directory with the original zone files (which get edited manually) rather clean and put the auto-generated files somewhere else.

Since I am not sure whether or not "Stackexchange - Information Security" is also intended to be used for specific implementation questions, please move the question if it doesn't fit here.


1 (Same ZSK):

You should not use the same ZSK for multiple zones (as far as I know), as it is a zone signing key. There should be one ZSK for every zone.

2 (Journal Files):

You cannot move the journal files with the current version of bind, however you can make the zone files in the directory bind uses symlinks to files in a cleaner directory.

  • Why shouldn't you sign multiple zones with the same ZSK? Deriving this policy from the name seems a little far-fetched... – Simon Fromme Aug 12 '16 at 7:14
  • Especially since OpenDNSSEC seems to be able to do exactly that. – Simon Fromme Aug 12 '16 at 12:51
  • Sorry, it appears that it is possible to use the same ZSK for multiple zones (I was under the impression you couldn't). However, it is recommended that you don't: users.isc.org/~jreed/dnssec-guide/… – ConnorJC Aug 12 '16 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.