Hurricane Electric's IPv6 Tunnel Broker Forums

DNS.HE.NET Topics => General Questions & Suggestions => Topic started by: sporkv6 on March 09, 2017, 05:55:32 PM

Title: DNSSEC for slaves?
Post by: sporkv6 on March 09, 2017, 05:55:32 PM
I'm new to DNSSEC with PowerDNS, so I'm possibly fighting two things at once - my ignorance of how PowerDNS compares to BIND in setting things up on my master, and then the possibility that HE.net DNS does not support/transfer all the necessary records.

Can anyone give a solid yes/no on whether *slaving* DNSSEC should work here or not?

I suspect not - when I query my own master for DS records, I get them, and when I query HE, no errors, but also no DS records.  Validated my domain, made sure serials match between master/slave, etc.
Title: Re: DNSSEC for slaves?
Post by: sporkv6 on March 10, 2017, 09:39:21 AM
Bump: Anyone?

To simplify, does HE.net's DNS service, when used as a slave/secondary, support DNSSEC?
Title: Re: DNSSEC for slaves?
Post by: broquea on March 10, 2017, 10:29:43 AM
DNSSEC support is not available as of yet.
Title: Re: DNSSEC for slaves?
Post by: primordial on May 14, 2017, 01:47:27 PM
Any chance of getting a status update on this feature?

It's been years that many of us have been waiting patiently. Last discussion in the forum was almost 2 years ago, and the home page still just says "We're looking into this now" which also hasn't changed in years.

Should we give up hope? HE is _awesome_ at being a proponent of IPv6 everywhere, but doesn't seem to have the same fondness for making sure it stays secure and trustworthy.
Title: Re: DNSSEC for slaves?
Post by: snarked on May 14, 2017, 01:59:13 PM
It will transfer the DNSSEC records as part of the zone data and store it, but it doesn't serve the data so no signatures go out in response to queries.  Also, there is currently no way to give HE the DS record content (for reverse zones only -- obviously).
Title: Re: DNSSEC for slaves?
Post by: BasicXP on August 24, 2017, 10:30:59 AM
Why won't the servers just return RRSIGs as is? Is there any extra processing required for them?
Title: Re: DNSSEC for slaves?
Post by: snarked on August 25, 2017, 06:42:24 PM
Serving these records IS extra processing that is not currently supported.
Title: Re: DNSSEC for slaves?
Post by: Jim Whitby on July 15, 2018, 11:59:38 AM
Has this policy changed for reverse-ip slaves?
Title: Re: DNSSEC for slaves?
Post by: snarked on July 22, 2018, 03:09:34 PM
Not that I have noted.  However, the word from the HE staff is what you need here.  I have personally inserted CSYNC and CDS/CDNSKEY records in all my zones (forward and reverse).  This is a relatively new option that some are working on.  Whether it will be supported here I cannot say.  My domain registrar for my forward zones is working on supporting these record types and their underlying features.