My attempt to DNSSEC has not been successful. To help understand DNSSEC I have read many online articles, man pages for rndc, dnssec-*, viewed dnsviz.net and dnssec-analyzer.verisignlabs.com/. Most of the information explains DNSSEC in great detail but I need to know WHAT to do and how to FIX the problems.
For example, dnsviz.net/allenintech.com indicates, "no valid DNSKEY records are provided by the authoritative name server to match the DS record published by the TLD name server".
HOW is a DNSKEY record provided by the NS to match the DS record published by the TLD? Is there a configuration I am missing? Are there rndc or dnssec-* commands to accomplish this?
System Ubuntu 20.04 BIND 9.16.1-Ubuntu (Stable Release) Apache/2.4.48 (Ubuntu)
named.conf Zone Files To trouble shoot the problems all except a few zones were retained. I thought reducing the zones would better help diagnose and fix the problems.
Notice Two views: inside and outside IP Local Server: 10.0.0.1 (inside view) Static IP Server: 99.93.25.17 (outside view) Secondary NS: 51.38.99.90
options{
directory "/etc/bind/zoneFiles/";
listen-on port 53 { 127.0.0.1; 10.0.0.1; 99.93.25.17; };
allow-transfer { none; };
dnssec-policy default;
bindkeys-file "/etc/bind/zoneFiles/bind.keys";
};
acl "mylo" {
127.0.0.1;
};
acl "mylan" {
10.0.0.0/24;
};
acl "mywireless" {
192.168.1.0/24;
};
view inside {
match-clients {"mylan"; "mylo"; "mywireless";};
recursion yes;
zone "." {
type hint;
file "/etc/bind/zoneFiles/root.hints";
};
zone "allenintech.com" {
type master;
file "/etc/bind/zoneFiles/insideView/allenintech.com.inside/db.allenintech.com.inside";
key-directory "/etc/bind/zoneFiles/insideView/allenintech.com.inside";
allow-transfer {51.38.99.90;};
};
};
view outside {
recursion no;
match-clients {any;};
allow-query {any;};
#--------------------------------------------------
zone "." {
type hint;
file "/etc/bind/zoneFiles/root.hints";
};
zone "allenintech.com" {
type master;
file "/etc/bind/zoneFiles/outsideView/allenintech.com.outside/db.allenintech.com.outside";
key-directory "/etc/bind/zoneFiles/outsideView/allenintech.com.outside";
allow-transfer {51.38.99.90;};
};
};
Inside View
$ORIGIN **allenintech.com.**
$TTL 86400
@ IN SOA ns2.allenintech.com. besus.allenintech.com. (
2022030750 ; Serial
28800 ; Refresh
120 ; Retry
1209600 ; Expire
86400 ; Minumum
)
; Name servers
@ IN NS ns2.allenintech.com.
ns2 IN A 10.0.0.1
; Web Services
www IN A 10.0.0.1
@ IN A 10.0.0.1
Outside View
$ORIGIN **allenintech.com.**
$TTL 86400
@ IN SOA ns1.allenintech.com. besus.allenintech.com. (
2022030725 ; Serial
28800 ; Refresh
120 ; Retry
1209600 ; Expire
86400 ; Minumum
)
; Name Servers
@ IN NS ns1.allenintech.com. ; primary
ns1 IN A 99.93.25.17 ; primary
NS fns2.42.pl. ; secondary
; Web Services
www IN A 99.93.25.17
@ IN A 99.93.25.17
**Current Images
Old images dnsviz dnssec-analyzer.verisignlab
Old Images https://dnssec-analyzer.verisignlabs.com/allenintech.com