Since the root of the DNS tree has been signed, how do I change my caching DNS server to start validating DNSSEC signatures?


Install and set up your nameserver (bind9 package) normally, and then just add the following stanza to /etc/bind/named.conf.options:

managed-keys {
  "." initial-key 257 3 8

Then restart the service (sudo service bind9 restart).

To make sure it is working, try to resolve "www.dnssec-failed.org", it should fail:

$ host www.dnssec-failed.org
Host www.dnssec-failed.org not found: 3(NXDOMAIN)

If it gives an IP address, then DNSSEC validation is not working.

  • Thanks. In what release is/was this done by default in Ubuntu?
    – nealmcb
    Aug 3 '11 at 23:25
  • The Debian instructions also say to add this to the options file: "dnssec-validation yes;"
    – nealmcb
    Aug 4 '11 at 23:09

You have a choice of at least two possible caching nameservers: bind9 and unbound.

Instructions on configuring and testing each of them with the current root key (first created in July of 2010) are in the Debian wiki:

You should be careful to validate the actual key that you add to the configuration, and not e.g. trust what you might find in a web site that doesn't use SSL (https) or that doesn't have secure management of its content. E.g. posting the actual key here is probably not wise, and it can change over time at any rate. The advice at the unbound site for "unbound-anchor" looks good, and when that command is securely available as part of an Ubuntu release it looks like that will be a good option. It looks like that has been enabled since unbound version 1.4.9-1 and is currently part of the Oneric release. See more at Debian bug #594911.

For bind9, follow Bug #782614 in bind9 (Ubuntu): “make configuring DNSSEC validation easier” for progress on making this process easier. It would seem to make sense to actually include the current key as part of the Ubuntu packaging of bind9, or add some sort of update mechanism like unbound-anchor, for the convenience and protection of the users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.