Hi Peter<div><br></div><div>Thanks a lot for the valuable input.</div><div>Appreciated!!!!!!!</div><div>So i think am close to wrap up my installation with 9 nodes in the cluster</div><div>Can you please also update me about </div>
<div>how to set NSEC3 narrow settings for a secured zone and how to do the same in NSEC3 inclusive mode. </div><div><br></div><div>And as Jose said in the very first reply,Can you please confirm me that do i have to perform a key rollover if i make any changes in a secure zone or PDNS manages that part automatically.</div>
<div><br></div><div>Info would of great help in my setup.</div><div>Really appreciated your's and jose input on my queries </div><div class="im" style><br></div><div class="im" style>Thanks a lot</div><div class="im" style>
<br></div><div class="im" style>Best Regards</div><div class="im" style>Parth Monga</div><div class="im" style><br></div><div class="im" style>> 2-When it is advised to roll over the keys in DNSSEC secured zones.DO i have to roll over the keys each time when i make changes to a secured zone data(like changing A records or Mx Records) or it will be automatically taken care by PDNS.Please elaborate this key roll over mechanism,a lot of confusion is there..<br>
<br></div><span style>Taken from the manual:</span><br style><br style><span style>"PowerDNS supports serving pre-signed zones, as well as online</span><br style><span style>('live') signed operations. In the last case, Signature Rollover and</span><br style>
<span style>Key Maintenance are fully managed by PowerDNS."</span><br style><br style><span style>When you add / remove records, you need to call 'pdnssec rectify-zone</span><br style><a href="http://example.com/" target="_blank" style>example.com</a><span style>' to make sure that the records orders are set properly.</span><br style>
<span style>This is important to use NSEC, that need the record before and after</span><br style><span style>to give a signed denial of existence. As far I remember, the field</span><br style><span style>content is not use in NSEC, so you can change this at will.</span><br style>
<div><span style>></span> </div><div><br><br><div class="gmail_quote">On Fri, Apr 13, 2012 at 3:30 PM, <span dir="ltr"><<a href="mailto:pdns-users-request@mailman.powerdns.com">pdns-users-request@mailman.powerdns.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Send Pdns-users mailing list submissions to<br>
<a href="mailto:pdns-users@mailman.powerdns.com">pdns-users@mailman.powerdns.com</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users" target="_blank">http://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:pdns-users-request@mailman.powerdns.com">pdns-users-request@mailman.powerdns.com</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:pdns-users-owner@mailman.powerdns.com">pdns-users-owner@mailman.powerdns.com</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of Pdns-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: Huge PDNS+DNSSEC setup-Need help (Peter van Dijk)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Fri, 13 Apr 2012 10:58:00 +0200<br>
From: Peter van Dijk <<a href="mailto:peter.van.dijk@netherlabs.nl">peter.van.dijk@netherlabs.nl</a>><br>
Subject: Re: [Pdns-users] Huge PDNS+DNSSEC setup-Need help<br>
To: pdns-users Users <<a href="mailto:pdns-users@mailman.powerdns.com">pdns-users@mailman.powerdns.com</a>><br>
Message-ID: <<a href="mailto:883423D7-537D-472A-A01E-A7FBAF4144B7@netherlabs.nl">883423D7-537D-472A-A01E-A7FBAF4144B7@netherlabs.nl</a>><br>
Content-Type: text/plain; charset=iso-8859-1<br>
<br>
Hi,<br>
<br>
On Apr 13, 2012, at 10:37 , PARTH MONGA wrote:<br>
<br>
> That for sure i will go with NSEC3 but whom to actually hit<br>
> NSEC3-inclusive or NSEC3-narrow<br>
><br>
> Please advice as not able to figure the difference between both NSEC3 modes.<br>
<br>
Benefits of narrow mode:<br>
- order name field does not matter (auth field still does)<br>
- no brute forcing calculation of names in your zones<br>
<br>
Downsides of narrow mode:<br>
- you cannot have AXFR slaves, all slaves need to be NATIVE (which would work for you)<br>
<br>
Benefits of inclusive mode:<br>
- behaviour is closer to what other name servers do, easier to understand when you get a DNSSEC expert to debug something<br>
- receives more testing than narrow<br>
<br>
Kind regards,<br>
--<br>
Peter van Dijk<br>
Netherlabs Computer Consulting BV - <a href="http://www.netherlabs.nl/" target="_blank">http://www.netherlabs.nl/</a><br>
<br>
<br>
<br>
------------------------------<br>
<br>
_______________________________________________<br>
Pdns-users mailing list<br>
<a href="mailto:Pdns-users@mailman.powerdns.com">Pdns-users@mailman.powerdns.com</a><br>
<a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users" target="_blank">http://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br>
<br>
<br>
End of Pdns-users Digest, Vol 111, Issue 16<br>
*******************************************<br>
</blockquote></div><br></div>