Re: non-working DNSSEC after network outage

On Thu, Aug 20, 2026 at 10:45:17PM -0700, Crist Clark wrote:
! Best practice is not to cache the root, but mirror it (RFC 8806). Mirroring
! and writing it to a local file would have prevented this. Something like,
! 
! zone "." {
!     type mirror;
!     file "/var/cache/bind/root.mirror";
! };

This didn't work for me.
(My log-book says, the problem is that a mirror zone needs an explicit
trust anchor.)

What does seem to work here is slaving the root zones (and I am doing
this for a lot longer than these RFCs got the similar idea):

view "rootslave" {
        match-clients { fcff::1; };    // extra loopback - I love IPv6
        allow-query-cache { none; };
        allow-recursion { none; };
        recursion no;
        dnssec-validation no;

        zone "." {
                type slave;
                file "/usr/local/etc/namedb/slave/root.slave";
                masters {
                        2620:0:2d0:202::132;    // lax.xfr.dns.icann.org
                        192.0.32.132;           // lax.xfr.dns.icann.org
                        <etc.etc.>
               }
                notify no;
        };
        zone "arpa" {
               <as before>
        zone "in-addr.arpa" {
               <as before>
        zone "ip6.arpa" {
               <as before>
}

view "guest" {
        match-clients { none; };
        max-cache-size  5%;

        zone "." {
                type static-stub;
                server-addresses { fcff::1; } ;
        };
        zone "arpa" {
        <etc.etc.>
        <local stuff>
}

view "intra" {
        match-clients { 127.0.0.0/8; ::1, 192.168.0.0/22; <etc.etc.>};
        max-cache-size  15%;
        zone "." {
                in-view "guest";
        };
        zone "arpa" {
                in-view "guest";
        };
        <etc.etc.>
        <local stuff>
}
-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.