Re: DNSSEC and DLZ

On Thu, Dec 31, 2015 at 04:15:20PM +1300, Mark Goldfinch wrote:
> Alternatively you will need to flow your DNS zone data through a system
> like OpenDNSSec before publishing it within your DLZ Bind database.

No, I'm afraid that still wouldn't work.  DLZ databases cannot answer
DNSSEC queries, except as a back-end server for zone transfers.

To serve DNSSEC, if you're answering a query for a name that doesn't exist,
you have to be able to prove that the name doesn't exist.  That involves
searching backward through the database for the closest previous record,
and then lookuping the NSEC record that's there, or using deliberately
obscure cryptographic hashing to find the associated NSEC3 record, and a
DLZ database can do neither -- the required database primitives simply
don't exist.

(There is a new mechanism called DynDB being introduced in the upcoming
BIND 9.11 which will be able to answer DNSSEC queries from an external
database; it was developed by Red Hat as part of their FreeIPA project.
However, the only DynDB driver that's been written so far is one they
developed for LDAP.)

-- 
Evan Hunt -- [email protected]
Internet Systems Consortium, Inc.

------------------------------------------------------------------------------