DNSSEC for slaves?

[sporkv6]

I'm new to DNSSEC with PowerDNS, so I'm possibly fighting two things at once - my ignorance of how PowerDNS compares to BIND in setting things up on my master, and then the possibility that HE.net DNS does not support/transfer all the necessary records.

Can anyone give a solid yes/no on whether *slaving* DNSSEC should work here or not?

I suspect not - when I query my own master for DS records, I get them, and when I query HE, no errors, but also no DS records.  Validated my domain, made sure serials match between master/slave, etc.

[sporkv6]

Bump: Anyone?

To simplify, does HE.net's DNS service, when used as a slave/secondary, support DNSSEC?

[broquea]

DNSSEC support is not available as of yet.

[primordial]

Any chance of getting a status update on this feature?

It's been years that many of us have been waiting patiently. Last discussion in the forum was almost 2 years ago, and the home page still just says "We're looking into this now" which also hasn't changed in years.

Should we give up hope? HE is _awesome_ at being a proponent of IPv6 everywhere, but doesn't seem to have the same fondness for making sure it stays secure and trustworthy.

[snarked]

It will transfer the DNSSEC records as part of the zone data and store it, but it doesn't serve the data so no signatures go out in response to queries.  Also, there is currently no way to give HE the DS record content (for reverse zones only -- obviously).

[BasicXP]

Why won't the servers just return RRSIGs as is? Is there any extra processing required for them?

[snarked]

Serving these records IS extra processing that is not currently supported.

[Jim Whitby]

Has this policy changed for reverse-ip slaves?

[snarked]

Not that I have noted.  However, the word from the HE staff is what you need here.  I have personally inserted CSYNC and CDS/CDNSKEY records in all my zones (forward and reverse).  This is a relatively new option that some are working on.  Whether it will be supported here I cannot say.  My domain registrar for my forward zones is working on supporting these record types and their underlying features.