<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; "><div>Hi there.</div><div><br></div><div>I am testing powerdnssec with one of my domains spam.co.nz</div><div><br></div><div>I have 2 PowerDNSSEC servers set up one as master and one as slave. I have used the normal powerdns for a long time with no problems</div><div><br></div><div>Both set up using gmysql backends (one on each) ,adding the data into the master mysql database and they replicate via zone transfers all ok into the slave mysql database;</div><div><br></div><div>I set up as in the instructions for the domain</div><div><br></div><div>Spam.co.nz</div><div><br></div><div>Master..</div><div><br></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 13px; white-space: pre; ">pdns<span class="searchword1" style="background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 255, 204); background-position: initial initial; background-repeat: initial initial; ">sec</span> <span class="searchword1" style="background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 255, 204); background-position: initial initial; background-repeat: initial initial; ">sec</span>ure-zone spam.co.nz </span></div><div><font class="Apple-style-span" face="monospace" size="3"><span class="Apple-style-span" style="font-size: 13px; white-space: pre;"><br></span></font></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 13px; white-space: pre; ">And</span></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 13px; white-space: pre; "><br></span></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 13px; white-space: pre; ">gmysql-host=127.0.0.1
gmysql-user=root
gmysql-password=
gmysql-dbname=pdns
gmysql-dnssec</span></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 13px; white-space: pre; ">master=yes</span></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 13px; white-space: pre; "><br></span></div><div><font class="Apple-style-span" face="monospace" size="3"><span class="Apple-style-span" style="font-size: 13px; white-space: pre;">Slave</span></font></div><div><font class="Apple-style-span" face="monospace" size="3"><span class="Apple-style-span" style="font-size: 13px; white-space: pre;"><br></span></font></div><div><font class="Apple-style-span" face="monospace" size="3"><span class="Apple-style-span" style="font-size: 13px; white-space: pre;">pdnssec </span></font><span class="Apple-style-span" style="font-size: 13px; font-family: Verdana, Arial, 'Bitstream Vera Sans', Helvetica, sans-serif; ">set-presigned spam.co.nz (set the domain to be presigned as its coming from ns1)</span></div><div><span class="Apple-style-span" style="font-size: 13px; font-family: Verdana, Arial, 'Bitstream Vera Sans', Helvetica, sans-serif; "><br></span></div><div><span class="Apple-style-span" style="font-size: 13px; font-family: Verdana, Arial, 'Bitstream Vera Sans', Helvetica, sans-serif; "><div>gmysql-host=127.0.0.1</div><div>gmysql-user=root</div><div>gmysql-password=</div><div>gmysql-dbname=pdns</div><div>gmysql-dnssec'</div><div>slave=yes</div></span></div><div><span class="Apple-style-span" style="font-size: 13px; font-family: Verdana, Arial, 'Bitstream Vera Sans', Helvetica, sans-serif; "><br></span></div><div><span class="Apple-style-span" style="font-size: 13px; font-family: Verdana, Arial, 'Bitstream Vera Sans', Helvetica, sans-serif; "><br></span></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 13px; white-space: pre; "><br></span></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 13px; white-space: pre; "><br></span></div><div><font class="Apple-style-span" face="monospace" size="3"><span class="Apple-style-span" style="font-size: 13px; white-space: pre;">I can update 114.23.33.130 and it updates on 114.23.33.131</span></font></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 13px; white-space: pre; "><br></span></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 13px; white-space: pre; ">Testing..</span></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 13px; white-space: pre; "><br></span></div><div><font class="Apple-style-span" face="monospace" size="3"><span class="Apple-style-span" style="font-size: 13px; white-space: pre;">dig +dnssec –T A spam.co.nz @114.23.33.130 gives</span></font></div><div><font class="Apple-style-span" face="monospace" size="3"><span class="Apple-style-span" style="font-size: 13px; white-space: pre;"><br></span></font></div><div><font class="Apple-style-span" face="monospace" size="3"><span class="Apple-style-span" style="font-size: 13px; white-space: pre;">spam.co.nz. 86400 IN A 114.23.33.130
spam.co.nz. 86400 IN RRSIG A 8 3 86400 20110616000000 20110602000000 45201 spam.co.nz. G8dEGkabnpInz47441Q6nUZkil0fBOjzll1jTRC8qGLx17baG7b30stf aNcRlVvWncvRWvjzMpWocKfUQJuGC5+F7rPLDVK/rRO4L7DATjEZ95eC tw2YfKEZHivKZbOlAEHKncd6A/VV4IOHRpl1ebx6/yQ8Vr36tojI06RW k9k=</span></font></div><div><font class="Apple-style-span" face="monospace" size="3"><span class="Apple-style-span" style="font-size: 13px; white-space: pre;"><br></span></font></div><div><font class="Apple-style-span" face="monospace" size="3"><span class="Apple-style-span" style="font-size: 13px; white-space: pre;">dig +dnssec –T A spam.co.nz @114.23.33.130</span></font></div><div><font class="Apple-style-span" face="monospace" size="3"><span class="Apple-style-span" style="font-size: 13px; white-space: pre;"><div>spam.co.nz.<span class="Apple-tab-span" style="white-space:pre"> </span>86400<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>RRSIG<span class="Apple-tab-span" style="white-space:pre"> </span>A 8 3 86400 20110616000000 20110602000000 45201 spam.co.nz. G8dEGkabnpInz47441Q6nUZkil0fBOjzll1jTRC8qGLx17baG7b30stf aNcRlVvWncvRWvjzMpWocKfUQJuGC5+F7rPLDVK/rRO4L7DATjEZ95eC tw2YfKEZHivKZbOlAEHKncd6A/VV4IOHRpl1ebx6/yQ8Vr36tojI06RW k9k=</div><div>spam.co.nz.<span class="Apple-tab-span" style="white-space:pre"> </span>86400<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>A<span class="Apple-tab-span" style="white-space:pre"> </span>114.23.33.130</div><div><br></div><div>So I extract the keys ..</div><div><br></div><div>pdnssec export-zone-dnskeys spam.co.nz 1 | grep DNSKEY > trustedkey</div><div><br></div><div>And test on 114.23.33.130</div><div><br></div><div>dig +dnssec +sigchase +trusted-key=./trustedkey –t A spam.co.nz @114.23.33.130</div><div><br></div><div>And..</div><div>..</div><div>..</div><div>;; WE HAVE MATERIAL, WE NOW DO VALIDATION
;; VERIFYING A RRset for spam.co.nz. with DNSKEY:45201: success
;; OK We found DNSKEY (or more) to validate the RRset
;; Ok, find a Trusted Key in the DNSKEY RRset: 22621
;; VERIFYING DNSKEY RRset for spam.co.nz. with DNSKEY:22621: success
;; Ok this DNSKEY is a Trusted Key, DNSSEC validation is ok: SUCCESS</div><div><br></div><div>Works..</div><div><br></div><div>But</div><div><br></div><div>dig +dnssec +sigchase +trusted-key=./trustedkey –t A spam.co.nz @114.23.33.131</div><div>…</div><div>…</div><div>;; WE HAVE MATERIAL, WE NOW DO VALIDATION
;; VERIFYING A RRset for spam.co.nz. with DNSKEY:45201: success
;; OK We found DNSKEY (or more) to validate the RRset
;; Now, we are going to validate this DNSKEY by the DS
;; the DNSKEY isn't trusted-key and there isn't DS to validate the DNSKEY: FAILED</div><div><br></div><div><br></div><div><br></div><div>Can someone help why the slave is failing…</div><div><br></div><div><br></div><div>I cannot find any documentation on slaves and powerdnssec and how it should be done properly..</div><div><br></div><div>Thanks</div><div>Craig</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></span></font></div></body></html>