How to prepublish additional DNSKEY

[Klaus Darilion]

Hello all!

A signed zone shall be moved to another DNS provider. Hence I want to add the public KSK of the gaining DNS provider as additional DNSKEY to the zone. My setup ist:

Bind1 as hidden primary --> Bind2 as bump-in-the-wire signer -> public facing secondaries

I tried to add the DNSKEY to the zone file of Bind1. Bind1 accepts the DNSKEY. But Bind2 only shows the DNSKEYs from the local key-directory, the original DNSKEY is removed/ignored.

I also tried to add the additonal DNSKEY into the key-directory of Bind2 (no .private file, only .key file). It did not worked too.

So, how is the correct process to add an additional DNSKEY (only the public key is known).

Thanks
Klaus