Created
February 18, 2016 17:53
-
-
Save hdais/3e9681fdeecfbea19ebe to your computer and use it in GitHub Desktop.
Negative Trust Anchor for BIND 9.10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| options { | |
| // Enable DNSSEC validation | |
| dnssec-validation auto; | |
| // set NTA to dnssec-failed.org | |
| // BIND9.10 and higher implements disable-ds-digests | |
| disable-ds-digests dnssec-failed.org { SHA-1; SHA-256; }; | |
| }; |
Author
This didn't work for insecure TLDs for me:
dnssec: validating tld/SOA: got insecure response; parent indicates it should be secure
So yes, this disables the DNSSEC validation for that domain, but if the parent mandates it to be secure, this doesn't help.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
You can configure NTA for BIND 9.10, though only BIND 9.11 implements NTA officially.
BIND9.10 performs DNSSEC validation as if there's none of DS digest algorithms for the domain specified in
disable-ds-digests. For DS digest algorithm mainlySHA-1andSHA-256are used. So in this configuration (nta-for-bind910.conf) BIND9.10 performs validation as ifdnssec-failed.orghas no DS records, which means the domain is "insecure".A few domains are using other algorithms such as SHA-384 or GOST. For such domains, specify these algorithm e.g.
disable-ds-digests example.com { SHA-384; };