<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Martijn,<div class=""><br class=""></div><div class="">Native zones with replication might be the easiest from a management point of view (remember to encrypt the replication data so that you don’t expose your keys), but online signing should work fine with slave zones.<div class=""><br class=""></div><div class="">Use "pdnsutil export-zone-key” to export the private key on the master, securely copy it to the slave servers somehow and then import it with "pdnsutil import-zone-key”.<div class=""><br class=""></div><div class="">You’re probably going to need to use "pdnsutil unset-presigned” as well as the zones are pre-signed at the moment.</div><div class=""><br class=""></div><div class="">Make sure you set any NSEC/NSEC3 parameters etc. the same on the slave servers - basically make the output of "pdnsutil show-zone” match between the master and slave.</div><div class=""><div class=""><br class=""><div class="">
<div>Edward Dore <br class="">Freethought Internet <br class=""></div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On 27 May 2020, at 10:39, Martijn Grendelman via Pdns-users <<a href="mailto:pdns-users@mailman.powerdns.com" class="">pdns-users@mailman.powerdns.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" class="">
<div class="">
Hi,<br class="">
<br class="">
We have a simple setup with a PowerDNS master and two PowerDNS
slaves (AXFR). Our zones are generally signed with DNSSEC and
everything has been working fine. Recently, I started experimenting
with LUA records, and for those, we're seeing problems (SERVFAIL)
when we query them through 3rd party resolvers.<br class="">
<br class="">
At first, I seem to have missed this tiny paragraph in the
documentation for LUA records:<br class="">
<br class="">
"LUA records can be DNSSEC signed, but because they are dynamic, it
is not
possible to combine pre-signed DNSSEC zone and LUA records. In other
words,
the signing key must be available on the server creating answers
based on
LUA records."<br class="">
<br class="">
It makes sense, and indeed, when I query the slaves for the LUA
records, I don't get any RRSIGs, so I suspect that this must be the
problem.<br class="">
<br class="">
My question is: <i class="">how</i> do I make the signing key availabe on
the slaves? Does this imply that I have to switch to a form of
native replication, or is there a way to make this work with AXFR? I
spent a few hours Googling for this, but I haven't found any clues.<br class="">
<br class="">
<div class="moz-signature">
<div id="divtagdefaultwrapper" style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif;" dir="ltr" class="">
<div id="Signature" class="">Met vriendelijke groet,<br class="">
Best regards,<br class="">
<br class="">
Martijn Grendelman<br class="">
<br class="">
<br class="">
<br class="">
</div>
</div>
</div>
</div>
_______________________________________________<br class="">Pdns-users mailing list<br class=""><a href="mailto:Pdns-users@mailman.powerdns.com" class="">Pdns-users@mailman.powerdns.com</a><br class="">https://mailman.powerdns.com/mailman/listinfo/pdns-users<br class=""></div></blockquote></div><br class=""></div></div></div></div></body></html>