Path: csiph.com!news.uzoreto.com!paganini.bofh.team!news.killfile.org!usenet.stanford.edu!not-for-mail
From: Klaus Darilion <klaus.darilion@nic.at>
Newsgroups: comp.protocols.dns.bind
Subject: AW: How to prepublish additional DNSKEY
Date: Thu, 9 Jul 2020 11:51:03 +0200
Lines: 19
Approved: bind-users@lists.isc.org
Message-ID: <mailman.657.1594288242.942.bind-users@lists.isc.org>
References: <3E18C1A0C550C44DA156DA5DA8ECCC6AB622808F@NICS-EXCH2.sbg.nic.at> <alpine.DEB.2.20.2007081628490.9145@grey.csi.cam.ac.uk> <3E18C1A0C550C44DA156DA5DA8ECCC6AB622A510@NICS-EXCH2.sbg.nic.at>
NNTP-Posting-Host: lists.isc.org
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
X-Trace: usenet.stanford.edu 1594288276 9460 149.20.1.60 (9 Jul 2020 09:51:16 GMT)
X-Complaints-To: action@cs.stanford.edu
Cc: "bind-users@lists.isc.org" <bind-users@lists.isc.org>
To: Tony Finch <dot@dotat.at>
Return-Path: <klaus.darilion@nic.at>
X-Original-To: bind-users@lists.isc.org
Delivered-To: bind-users@lists.isc.org
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nic.at; s=it2019; h=From:From:To:CC:Subject:Date:Message-Id:Content-Type:Received:Received; bh=9xvxl/Ms8EWb2y8qamIk7keZTd29lGqr2/aTHaVAh/g=; b=HTzTMvvDDQgvpRU+f7yUBMTlfOHUuJMUE4RDiDhZPqxTqL9snPTdT7ChTk2XSbtDLv1b0sms/CRJDCHXPoNStypJHUjiWbuxQPjBE815woQ6fE+CLQmBQmsvzERoFgXYHg6o4yXinlQ57ZPtHudpiOnevvT5nlLrQGnsZUEIQgdWMp5CHhy7frL8g0OjQ3KvWxnw4Z3qeNH/p6b8H/ZCeyCwMuBRUfIvFZtfQHg9ikH5zeXUv/mYi96PL6nNGyLnDLuUb8mImGahmlOtJEm7qmcfEm+6eaf2XUNP751nuG2E1WSzxtYtgsym9PSNb8XPqbC0KvsjD7wAKBpRYXba9Q==;
Thread-Topic: How to prepublish additional DNSKEY
Thread-Index: AdZVBFvzLSjkENOpTXuVkOraJnUuBAAJ93OAACpSN0A=
In-Reply-To: <alpine.DEB.2.20.2007081628490.9145@grey.csi.cam.ac.uk>
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [192.168.7.4]
X-Assembled-By: XWall v3.56
X-XWALL-BCKS: auto
X-Spam-Status: No, score=-5.2 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI,RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_PASS autolearn=disabled version=3.4.2
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mx.pao1.isc.org
X-BeenThere: bind-users@lists.isc.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: BIND Users Mailing List <bind-users.lists.isc.org>
List-Unsubscribe: <https://lists.isc.org/mailman/options/bind-users>, <mailto:bind-users-request@lists.isc.org?subject=unsubscribe>
List-Archive: <https://lists.isc.org/pipermail/bind-users/>
List-Post: <mailto:bind-users@lists.isc.org>
List-Help: <mailto:bind-users-request@lists.isc.org?subject=help>
List-Subscribe: <https://lists.isc.org/mailman/listinfo/bind-users>, <mailto:bind-users-request@lists.isc.org?subject=subscribe>
X-Mailman-Original-Message-ID: <3E18C1A0C550C44DA156DA5DA8ECCC6AB622A510@NICS-EXCH2.sbg.nic.at>
X-Mailman-Original-References: <3E18C1A0C550C44DA156DA5DA8ECCC6AB622808F@NICS-EXCH2.sbg.nic.at> <alpine.DEB.2.20.2007081628490.9145@grey.csi.cam.ac.uk>
Xref: csiph.com comp.protocols.dns.bind:15937

> > So, how is the correct process to add an additional DNSKEY (only the pub=
lic
> key is known).
>=20
> I think you are looking for `dnssec-importkey`.

Indeed. I imported the key and got a .key and .private file. I put those fil=
es in the same directory as the other keys, gave read permissions to bind an=
d executed:
rndc loadkeys myzone
rndc sign myzone

But the additional key is not added to the reponse of DNSKEY queries.

I am using Bind - 9.12.2-P2. Is this supported by Bind 9.12? (upgrade/downgr=
ade is currently not possible)

Thanks
Klaus