{"id":754,"date":"2021-04-17T10:40:20","date_gmt":"2021-04-17T10:40:20","guid":{"rendered":"https:\/\/blog.stmellion.org\/?p=754"},"modified":"2021-04-17T10:40:20","modified_gmt":"2021-04-17T10:40:20","slug":"dnssec-signing-a-zone","status":"publish","type":"post","link":"https:\/\/blog.stmellion.org\/?p=754","title":{"rendered":"DNSSEC signing a zone"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Every time I add a new domain, I wade through the process of how to generate the required keys and how to get the records that need to be published at my upstream registrar.  Hopefully this will help in future!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">First off, some assumptions:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Bind is installed and running<\/li><li>Zones are in \/etc\/bind\/zones<\/li><li>Keys are in \/etc\/bind\/keys<\/li><li>The zone to secure with DNSSEC already has an active zone file (without DNSSEC).<\/li><li>You have root (or sudo) access<\/li><\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Generate the zone keys:<\/h4>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>cd \/etc\/bind\/zones<\/code><br><code>dnssec-keygen -a RSASHA256 -b 2048 -3 newzone.org<\/code><br><code>dnssec-keygen -a RSASHA256 -b 2048 -3 -fk newzone.org<\/code><\/pre>\n\n\n\n<p class=\"has-small-font-size wp-block-paragraph\">If your TLD supports it, you should probably use ED25519 (type 15) instead of RSASHA256 (type 8).  At the time of writing, there isn&#8217;t much support for ED25519.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Edit the zone file<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Insert the following new lines into the zone configuration:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>auto-dnssec maintain;<\/code>\n<code>inline-signing yes;<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Reload bind<\/h4>\n\n\n\n<p class=\"has-small-font-size wp-block-paragraph\">On my system, the systemd service is called named.  Yours may differ.<br><code>systemctl reload named.service<\/code><\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Sign the zone<\/h4>\n\n\n\n<p class=\"has-small-font-size wp-block-paragraph\"><code>rndc signing -nsec3param 1 0 10 deadbeef newzone.org<\/code><br>(Where deadbeef is a random 4 byte hex salt)<br>You can generate the random salt with:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>hexdump -n 4 -e '4\/4 \"%08X\" 1 \"\\n\"' \/dev\/random<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Grab the dsset record for your registrar<\/h4>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>dig @127.0.0.1 dnskey newzone.org | dnssec-dsfromkey -f - newzone.org<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Every time I add a new domain, I wade through the process of how to generate the required keys and how to get the records that need to be published at my upstream registrar. Hopefully this will help in future! First off, some assumptions: Bind is installed and running Zones are in \/etc\/bind\/zones Keys are&hellip; <a class=\"more-link\" href=\"https:\/\/blog.stmellion.org\/?p=754\">Continue reading <span class=\"screen-reader-text\">DNSSEC signing a zone<\/span><\/a><\/p>\n","protected":false},"author":24,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[40],"class_list":["post-754","post","type-post","status-publish","format-standard","hentry","category-general","tag-dnssec","entry"],"_links":{"self":[{"href":"https:\/\/blog.stmellion.org\/index.php?rest_route=\/wp\/v2\/posts\/754","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.stmellion.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.stmellion.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.stmellion.org\/index.php?rest_route=\/wp\/v2\/users\/24"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.stmellion.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=754"}],"version-history":[{"count":4,"href":"https:\/\/blog.stmellion.org\/index.php?rest_route=\/wp\/v2\/posts\/754\/revisions"}],"predecessor-version":[{"id":758,"href":"https:\/\/blog.stmellion.org\/index.php?rest_route=\/wp\/v2\/posts\/754\/revisions\/758"}],"wp:attachment":[{"href":"https:\/\/blog.stmellion.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=754"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.stmellion.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=754"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.stmellion.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=754"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}