LWN.net Logo

An interesting DNSSEC amplification

An interesting DNSSEC amplification

Posted Jul 15, 2010 14:32 UTC (Thu) by cesarb (subscriber, #6266)
In reply to: An interesting DNSSEC amplification by Cyberax
Parent article: An interesting DNSSEC amplification

Yes, AFAIK you will need to add it manually as a trust anchor. Be sure to have some way to deal with key rollover (or it will mysteriously stop working as a DNS server at some point in the future). I would recommend using "managed-keys" instead of "trusted-keys" to avoid any problems (see the fine manual at http://oldwww.isc.org/sw/bind/arm97/Bv9ARM.ch06.html#id25...).

I do not know whether ISC's DLV (http://www.isc.org/solutions/dlv) will be updated to use the DNS root key. If it is and you are already using ISC's DLV, you might not need to do anything at first (at least until it is shut down for not being needed anymore).

You can also simply wait for your distribution to update their packages, if you used it to configure DNSSEC (for instance, IIRC Fedora 13's bind package uses DNSSEC via ISC's DLV by default; it will not surprise me if it is updated soon to add the true DNS root key).


(Log in to post comments)

Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds