DNSSEC signing of an internal zone gains nothing (unless??)

[John W. Blue]

Keep in mind that the discussion is limited to an internal zone only.  Running authoritative and recursive at the same time cannot be labeled as a “terribly bad practice”:

https://kb.isc.org/docs/bind-best-practices-recursive

“administrators may, for convenience, choose to serve some internal-only zones authoritatively from their recursive servers”

John

From: bind-users [mailto:bind-users-bounces at lists.isc.org] On Behalf Of Mark Elkins via bind-users
Sent: Monday, August 1, 2022 1:12 PM
To: bind-users at lists.isc.org
Subject: Re: DNSSEC signing of an internal zone gains nothing (unless??)


Hmmm - might be saying the wrong thing but...

.SE was DNSSEC Signed waaay before the root, so if living in Sweden, one would prep your DNSSEC aware resolver with the DS Key of the .SE Zone. DNSSEC then worked for .SE domains. Perhaps do the same?

I do get confused further down in this email when one says you'll get back an "AA" flag in the answer. That will only happen if you ask the Authoritative Server for the domain you are looking in. That shouldn't be a Recursive server. It is terribly bad practice to have a BIND server running in both Authoritative and Recursive mode at the same time - should be two separate instances of BIND.
On 8/1/22 7:51 PM, John W. Blue via bind-users wrote:

Also do not disagree.



However, the intent of the thread is to talk about the lack of an AD flag from a non-public internal authoritative server.  Based upon what I am seeing only the AA flag is set.



John



-----Original Message-----

From: John Franklin [mailto:franklin at sentaidigital.com]

Sent: Monday, August 1, 2022 12:45 PM

To: John W. Blue

Cc: bind-users at lists.isc.org<mailto:bind-users at lists.isc.org>

Subject: Re: DNSSEC signing of an internal zone gains nothing (unless??)



On Aug 1, 2022, at 12:15, John W. Blue via bind-users <bind-users at lists.isc.org><mailto:bind-users at lists.isc.org> wrote:



As some enterprise networks begin to engineer towards the concepts of ZeroTrust, one item caught me unaware:  PM’s asking for the DNSSEC signing of an internal zone.



Granted, it has long been considered unwise by DNS pro’s with a commonly stated reason that it increasing the size of the zone yadda, yadda, yadda.

 [snip]

Thoughts?



DNSSEC enables use of certain security RRs, such as SSHA and TLSA, which can be used as part of a zero trust solution in DevOps pipelines.  It’s also good practice managing DNSSEC before deploying it in public production sites.



jf
--

Mark James ELKINS  -  Posix Systems - (South) Africa
mje at posix.co.za<mailto:mje at posix.co.za>       Tel: +27.826010496<tel:+27826010496>
For fast, reliable, low cost Internet in ZA: https://ftth.posix.co.za

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20220801/ece1e70a/attachment.htm>