• Welcome to Hurricane Electric's IPv6 Tunnel Broker Forums.

News:

Welcome to Hurricane Electric's Tunnelbroker.net forums!

Main Menu

DNSSEC for slaves?

Started by sporkv6, March 09, 2017, 05:55:32 PM

Previous topic - Next topic

sporkv6

I'm new to DNSSEC with PowerDNS, so I'm possibly fighting two things at once - my ignorance of how PowerDNS compares to BIND in setting things up on my master, and then the possibility that HE.net DNS does not support/transfer all the necessary records.

Can anyone give a solid yes/no on whether *slaving* DNSSEC should work here or not?

I suspect not - when I query my own master for DS records, I get them, and when I query HE, no errors, but also no DS records.  Validated my domain, made sure serials match between master/slave, etc.

sporkv6

Bump: Anyone?

To simplify, does HE.net's DNS service, when used as a slave/secondary, support DNSSEC?

broquea

DNSSEC support is not available as of yet.

primordial

Any chance of getting a status update on this feature?

It's been years that many of us have been waiting patiently. Last discussion in the forum was almost 2 years ago, and the home page still just says "We're looking into this now" which also hasn't changed in years.

Should we give up hope? HE is _awesome_ at being a proponent of IPv6 everywhere, but doesn't seem to have the same fondness for making sure it stays secure and trustworthy.

snarked

It will transfer the DNSSEC records as part of the zone data and store it, but it doesn't serve the data so no signatures go out in response to queries.  Also, there is currently no way to give HE the DS record content (for reverse zones only -- obviously).

BasicXP

#5
Why won't the servers just return RRSIGs as is? Is there any extra processing required for them?

snarked

Serving these records IS extra processing that is not currently supported.

Jim Whitby

Has this policy changed for reverse-ip slaves?

snarked

Not that I have noted.  However, the word from the HE staff is what you need here.  I have personally inserted CSYNC and CDS/CDNSKEY records in all my zones (forward and reverse).  This is a relatively new option that some are working on.  Whether it will be supported here I cannot say.  My domain registrar for my forward zones is working on supporting these record types and their underlying features.