<html><head></head><body> <div dir="auto"><span dir="auto" style="color: var(--text-color);"><caret></caret>Op ma 22 mei , Joe Abley <</span><a class="" href="mailto:Op ma 22 mei , Joe Abley <<a href=">jabley@strandkip.nl</a><span style="color: var(--text-color);">> schreef:</span><br></div><blockquote type="cite" class="protonmail_quote"> <div dir="auto"><span style="color: var(--text-color);" dir="auto">Op ma 22 mei , Julian Fölsch <</span><a href="mailto:Op ma 22 mei , Julian Fölsch <<a href=" class="">julian.foelsch@agdsn.de</a><span style="color: var(--text-color);">> schreef:</span><br></div><blockquote dir="auto" class="protonmail_quote" type="cite">This however had the side effect that child zones that are not signed were no<br>longer resolving so I thought "Lets just sign them. Can't be that hard,<br>right?"</blockquote><div dir="auto"><br></div><div dir="auto">Verifiably-insecure delegations (a zone cut with no DS records on the parent side) should not be a problem to resolve through a validating resolver. You shouldn't have to sign your child zones to make them work. <span style="color: var(--text-color);">It seems possible that something else was wrong?</span></div></blockquote><div dir="auto"><br></div><div dir="auto">Actually, here's a thought -- check that the zone cuts actually exist (that the parent has a delegating NS set, and that the child has apex SOA and NS sets).</div><div dir="auto"><br></div><div dir="auto">If your parent zone and child zones were hosted on the same servers, lack of zone cuts wouldn't matter if they were all unsigned (there's no referral to return, so the lack of a delegation goes unnoticed).</div><div dir="auto"><br></div><div dir="auto">However you need the delegation to be present if you want to signal that the child zone is unsigned. </div><div dir="auto"><br></div><div dir="auto">Just guessing, but I've seen this kind of thing before (and not just in enterprise zones). <caret></caret></div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto">Joe</div><blockquote type="cite" class="protonmail_quote" dir="auto"><div dir="auto"></div></blockquote></body></html>