Re: DNSSEC domain and sub-domains

2014-04-24 Thread rod
On Apr 24, 2014, at 11:01 AM, Tony Finch wrote: > r...@iastate.edu wrote: > >> If we implement DNSSEC for iastate.edu, admin.iastate.edu and >> its.iastate.edu, must DNSSEC be implemented for the delegated zones as >> well? > > No, in exactly the same way that signing .edu does not mean iasta

Re: DNSSEC domain and sub-domains

2014-04-24 Thread Tony Finch
r...@iastate.edu wrote: > If we implement DNSSEC for iastate.edu, admin.iastate.edu and > its.iastate.edu, must DNSSEC be implemented for the delegated zones as > well? No, in exactly the same way that signing .edu does not mean iastate.edu has to be signed. If there are no DS records at the del

DNSSEC domain and sub-domains

2014-04-24 Thread rod
We are getting ready to implement DNSSEC on our campus. Our main domain is iastate.edu. I have zone records for department and units, such as admin.iastate.edu, its.iastate.edu, cs.iastate.edu and ee.iastate.edu. Two of the zones are delegated (cs.iastate.edu and ee.iastate.edu). If we implement