Re: DNSSEC + Split DNS

Brian Candler via Pdns-users <[email protected]> Thu, 9 Apr 2026 09:38:19 +0100
Newsgroups	gmane.network.dns.powerdns.user
Message-ID	<[email protected]>
This is a multi-part message in MIME format.
--===============5982789678618266006==
Content-Type: multipart/alternative;
 boundary="------------CRTjaHfNnwzKBIITMAY0ze7Q"
Content-Language: en-GB

This is a multi-part message in MIME format.
--------------CRTjaHfNnwzKBIITMAY0ze7Q
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

On 09/04/2026 09:13, rob777 via Pdns-users wrote:
> Do i create a mess with this planned DNSSEC enabling on the external 
> test.com <http://test.com> DNS Zone?

If it's just a case of private, unsigned subdomains of test.com, then 
all you need to do is to set Negative Trust Anchors for these subdomains 
on your internal recursor(s), and it will be fine.

See: https://doc.powerdns.com/recursor/settings.html#forward-zones

The fact that you have conflicting parent zones ("shadow zone") might be 
more problematic, but I'm not sure. Personally, I'd get rid of the 
shadow test.com zone and use an RPZ to override the specific answers 
that you want to be different for internal clients - which you say is 
only 2 or 3 records. It's much more maintainable too, since anything you 
add to the public test.com zone will be visible to internal clients 
automatically; you don't have to keep the shadow zone file in sync.

https://doc.powerdns.com/recursor/lua-config/rpz.html


--------------CRTjaHfNnwzKBIITMAY0ze7Q
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-cite-prefix">On 09/04/2026 09:13, rob777 via
      Pdns-users wrote:<br>
    </div>
    <blockquote type="cite"
cite="mid:CAAPVCxygaFZvnrmekntj0fTiZuTg1J+N+sKBAk1-jeS5h667eA@mail.gmail.com">Do
      i create a mess with this planned DNSSEC enabling on the external
      <a href="http://test.com" moz-do-not-send="true">test.com</a> DNS
      Zone?</blockquote>
    <p>If it's just a case of private, unsigned subdomains of test.com,
      then all you need to do is to set Negative Trust Anchors for these
      subdomains on your internal recursor(s), and it will be fine.</p>
    <p>See:
      <a class="moz-txt-link-freetext" href="https://doc.powerdns.com/recursor/settings.html#forward-zones">https://doc.powerdns.com/recursor/settings.html#forward-zones</a></p>
    <p>The fact that you have conflicting parent zones ("shadow zone")
      might be more problematic, but I'm not sure. Personally, I'd get
      rid of the shadow test.com zone and use an RPZ to override the
      specific answers that you want to be different for internal
      clients - which you say is only 2 or 3 records. It's much more
      maintainable too, since anything you add to the public test.com
      zone will be visible to internal clients automatically; you don't
      have to keep the shadow zone file in sync.</p>
    <p><a class="moz-txt-link-freetext" href="https://doc.powerdns.com/recursor/lua-config/rpz.html">https://doc.powerdns.com/recursor/lua-config/rpz.html</a></p>
    <p><br>
    </p>
  </body>
</html>

--------------CRTjaHfNnwzKBIITMAY0ze7Q--

--===============5982789678618266006==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Pdns-users mailing list
[email protected]
https://mailman.powerdns.com/mailman/listinfo/pdns-users

--===============5982789678618266006==--