2

I have a local DNS server (BIND 9.10). I just configured DNSEC, but I am facing problems at the client-side (python script).

How can I test if my DNS server is configured correctly? That the DNSSEC is correct?

EDIT: I am running an authoritative server and want to sign my own zone. My zone name is com. I have two servers, say: a.com and b.com.

I am running a resolver (at the client-side using python dnspython), and I want to validate received signatures?

I want to make a simple setting. I do not need the trust chain. The client just wants to check the authenticity of the Zone Signing Key (ZSK) using the DNS Key Signing Key (KSK). No higher levels of validation needed in my set-up.

More about my zone signed file, and my client can be found here and another more technical one in stack-overflow here. Please let me know if you need more details. I also cut the full signature from my posts for brevity and use general names of the servers: a.com and b.com for privacy.

Improve this question
5
  • That's about as specific as "I configured the internet." How do you want to use DNSSEC? Are you running an authoritative server and want to sign your own zone? Are you running a resolver and want to validate received signatures? Are you trying to use DNSSEC for authenticating zone transfers or dynamic updates?
    – u1686_grawity
    May 24, 2018 at 9:42
  • @grawity please check my edit. I hope you can help and please let me know if you have more questions in order to help me.
    – user9371654
    May 24, 2018 at 9:55
  • @grawity one more important question I have, where should I save the keys? I am placing them in: /etc/bind where the zone file and the .signed zone file are.
    – user9371654
    May 24, 2018 at 9:57
  • The exact location doesn't matter (with BIND even the zone locations aren't quite standardized), as long as they're readable by BIND itself but not readable by other users of course. I suppose /etc/bind is okay.
    – u1686_grawity
    May 24, 2018 at 10:12
  • @grawity Could you figure out the original post problem?
    – user9371654
    May 24, 2018 at 10:14

1 Answer 1

Reset to default
1

https://dnssec-debugger.verisignlabs.com/ this might help? Run the domain through this. Will not work if the server is NOT on WAN

Improve this answer
2
  • 1
    It is a private network with private IPs (not public) so online tools will not recognize it.
    – user9371654
    May 25, 2018 at 0:40
  • Awwf. Well, as i expected, but i googled a little and found this tool: dnssec-tools.org inside here you have a link to a download. I have not tested or checked the link by myself but i would make it a try. Looks legit for me.
    – godzillamesel
    May 25, 2018 at 6:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .