<html><head></head><body> <div dir="auto"><span dir="auto" style="color: var(--text-color);">Op ma 22 mei , Julian Fölsch <</span><a class="" href="mailto:Op ma 22 mei , Julian Fölsch <<a href=">julian.foelsch@agdsn.de</a><span style="color: var(--text-color);">> schreef:</span><br></div><blockquote type="cite" class="protonmail_quote" dir="auto">This however had the side effect that child zones that are not signed were no<br>longer resolving so I thought "Lets just sign them. Can't be that hard,<br>right?"</blockquote><div dir="auto"><br></div><div dir="auto">Verifiably-insecure delegations (a zone cut with no DS records on the parent side) should not be a problem to resolve through a validating resolver. You shouldn't have to sign your child zones to make them work. <span style="color: var(--text-color);">It seems possible that something else was wrong?</span></div><div dir="auto"><caret></caret><br></div><blockquote type="cite" class="protonmail_quote" dir="auto">I was very wrong.<br>One of the child zones is for hosts using DHCP and is managed by dnsmasq that<br>unfortunately can't sign the zone.<br>But it can do zone transfers.<br>So we tried a setup using opendnssec as a signing proxy that transfers the<br>zone to an unbound.<br>Unfortunately this has proven unreliable at best and broken at worst so I am<br>looking to replace that.</blockquote><div dir="auto"><br></div><div dir="auto">There are a variety of other DNSSEC signers that can act as "bump in the wire" signers (where the "wire" is [AI]XFR). There are people who actually write that kind of software on this list and my hands-on with this stuff is a bit long in the tooth, so I won't try to speak for any of them.<caret></caret></div><br><blockquote type="cite" class="protonmail_quote" dir="auto">I was just looking around for a DHCP server that directly can sign the zone<br>but I was unable to find something so far.<br>So I was wondering how other people are doing this.<br><br>Are you signing DHCP zones?<br>Would you recommend (not) doing it?<br>If you are doing it, how are you doing it?</blockquote><div dir="auto"><br></div>It used to be quite common to glue DHCP servers to the DNS using dynamic updates, so that a DHCP server sends a DNS UPDATE when it wants to add or drop a binding to an address. If the DNS <caret></caret>server handling the DNS UPDATE requests can also act as a DNSSEC signer, that might work for you. I have set up BIND9 like that before and it was fairly painless. <div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto">Joe</div></body></html>