feat: DNSSEC #227

NicTool version

2.34

perl version

5.24

OS version

FreeBSD 11.1-RELEASE-p8

I have a question about DNSSEC (because local TV reported about the lack of DNSSEC at our local banks' websites, we suddenly get people asking about DNSSEC...).

I've downloaded Mr Lucas book on the subject (DNSSEC Mastery) and the path seems to be:

• generate KSK
• generate ZSK

have a zonefile-configuration like:

zone "blackhelicopters.org" {
type master;
file "master/blackhelicopters.org";
inline-signing yes;
key-directory "keys/blackhelicopters.org";
auto-dnssec maintain;
};

and then run a reload, publish the DNSKEY, DS-records upstream.

However, these keys would have to be generated.
There is no API for this. Even more important: is it actually advisable to generate the keys as part of an API-call? It's unclear how long that would take and I presumed that the API calls were designed to return instantly?

Then, I use rsync to distribute my zonefiles to BIND nameservers - is that even possible for these generated files?

• filename is the original text zone file, unmolested by named
• filename.jnl is the journal for the named-created dynamic zone
• filename.jbk is a temporary file for the dynamic zone
• filename.signed is the signed zone
• filename.signed.jnl is the journal for the signed dynamic zone.

I haven't tried, but I'm not sure these jnl-files are meant to be rsync'ed around...

Anyone ever explored Nictool+DNSSEC?