Re: Server Keys

2019-11-11 Thread Mark Andrews
> On 12 Nov 2019, at 17:27, Mundile wrote: > > How do include a list of keys in BIND9 server clause: You don’t. Only a single key is supported optionally surrounded by braces. For key rollover you update the server side to support multiple keys rather than have the client side try multiple k

Server Keys

2019-11-11 Thread Mundile
How do include a list of keys in BIND9 server clause: server ip-addr { [ keys "key-name"; ["key-name"; ... ; ] ;} For example, I have tried the following but it is giving errors server 162.0.4.49 { keys { tsig.example.org1 ; tsig.example.org2; tsig.example.org3 }; }; Sent from Mail for Windows

Re: .onion and dnssec

2019-11-11 Thread Erich Eckner
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi Tony, On Mon, 11 Nov 2019, Tony Finch wrote: Erich Eckner wrote: However, I encounter the issue here: https://lists.isc.org/mailman/htdig/bind-users/2011-November/085536.html If you are running 9.14 (or newer) you can use the validate-exc

Re: Debug logging for auto-dnssec inline signing

2019-11-11 Thread Matthew Richardson
Tony Finch wrote:- >> What "category" should one be logging in order to get details of DNSSEC >> inline signing when running Bind 9.8.11? > >I guess you mean 9.11.8 :-) The 9.8 branch ended with 9.8.8 and it has >been unsupported for ages. Correct - I need to practice my proof reading skills :-(

Re: .onion and dnssec

2019-11-11 Thread Tony Finch
Erich Eckner wrote: > > However, I encounter the issue here: > https://lists.isc.org/mailman/htdig/bind-users/2011-November/085536.html If you are running 9.14 (or newer) you can use the validate-except configuration option. In older versions you can use `rndc nta` but that is very inconvenient i

.onion and dnssec

2019-11-11 Thread Erich Eckner
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi, I'm running a recursive bind (root hint, several master zones for opennic tlds) and would like to extend it by resolving .onion addresses through my tor node. Naively, I tried to add this to my config file: zone "onion" IN { type forwa

Re: Debug logging for auto-dnssec inline signing

2019-11-11 Thread Tony Finch
Matthew Richardson wrote: > What "category" should one be logging in order to get details of DNSSEC > inline signing when running Bind 9.8.11? I guess you mean 9.11.8 :-) The 9.8 branch ended with 9.8.8 and it has been unsupported for ages. Yes, there is not very much logging automatic zone sig