I have a local DNS server (BIND 9.10). I just ocnfigured DNSEC but I am facing problems at the client side (python script).

How can I test if my DNS server is configured correctly? that the DNSSEC is correct?

EDIT: I am running authoritative server and want to sign my own zone. My zone name is com, I have two servers, say: a.com and b.com.

I am running a resolver (at the client side using python dnspython) and I want to validate received signatures?

I want to make a simple setting. I do not need the trust chain. The client jsut want to check the authenticity of the Zone Siging Key (ZSK) using the DNS Key Signing Key (KSK). No more higher levels validation needed in my set-up.

More about my zone signed file, and my client can be found here and another more technical one in stack-overflow here. Please let me know if you need more details. I also cut the full signature from my posts for brevity and use general names of the servers: a.com and b.com for privacy.

  • That's about as specific as "I configured the internet." How do you want to use DNSSEC? Are you running an authoritative server and want to sign your own zone? Are you running a resolver and want to validate received signatures? Are you trying to use DNSSEC for authenticating zone transfers or dynamic updates? – user1686 May 24 '18 at 9:42
  • @grawity please check my edit. I hope you can help and please let me know if you have more questions in order to help me. – user9371654 May 24 '18 at 9:55
  • @grawity one more important question I have, where should I save the keys? I am placing them in: /etc/bind where the zone file and the .signed zone file are. – user9371654 May 24 '18 at 9:57
  • The exact location doesn't matter (with BIND even the zone locations aren't quite standardized), as long as they're readable by BIND itself but not readable by other users of course. I suppose /etc/bind is okay. – user1686 May 24 '18 at 10:12
  • @grawity Could you figure out the original post problem? – user9371654 May 24 '18 at 10:14

https://dnssec-debugger.verisignlabs.com/ this might help? Run the domain through this. Will not work if the server is NOT on WAN

  • 1
    It is a private network with private IPs (not public) so online tools will not recognize it. – user9371654 May 25 '18 at 0:40
  • Awwf. Well, as i expected, but i googled a little and found this tool: dnssec-tools.org inside here you have a link to a download. I have not tested or checked the link by myself but i would make it a try. Looks legit for me. – godzillamesel May 25 '18 at 6:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.