parental-agents clause - IP address only ?

[Nick Tait]

On 5/12/22 15:34, vom513 wrote:
> Hello all,
>
> So I set up parental-agents lists for my zones, and actually got to see it work (awesome !).  bind detected the parent DS records and acted accordingly.
>
> However, I currently have these lists configured using the IP (v4 only at the moment) addresses of the parent NS’es.  I tried inputting hostnames, and I got errors (i.e. syntax) every time.
>
> I would prefer to put these in as hostnames.  While at a certain level in the tree these don’t change very often, they can and do.  I’d rather not have to keep track of these in this manner.
>
> So my question - am I just mangling the syntax - or does this clause really only support IPs ?  I was thinking if so - perhaps the reason is some chicken vs. egg / security reason ?  I.e. not trusting the name (which would have to be itself resolved) ?
>
> Thanks in advance for clue++
Although I haven't personally set up parental-agents (yet), I noticed an 
interesting remark in section 8.2.26.1 of the documentation 
(https://bind9.readthedocs.io/en/v9_18_8/reference.html#automated-ksk-rollovers) 
- NB: italics added for emphasis:

>     Note
>
>     The DS response is not validated so it is recommended to set up a
>     trust relationship with the parental agent. For example, use TSIG
>     to authenticate the parental agent, /or point to a validating
>     resolver/.
>
So you might consider pointing your parental-agents at (an IP address 
of) your local resolver(s), instead of the parent NSs?

However the obvious drawback of this approach would seem to be that the 
resolver will only check one of the parent NSs for the DS record, 
whereas if you explicitly specify all the NSs in parental-agents, then 
they all get checked?

Nick.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20221205/bd73b2fa/attachment.htm>