'inline-signing' might go away and be replaced by dnssec-policy ?

PGNet Dev pgnet.dev at gmail.com
Wed Oct 26 14:57:40 UTC 2022


>> There are two ways of DNSSEC maintenance in BIND. One is the inline-signing approach, that preserves the original zone file. The other is to apply the changes directly to the zone (and zone file) and requires the zone to allow dynamic updates.
>> Since the latest release dnssec-policy requires either inline-signing to be set to yes, or allow dynamic updates.
>>
>> I am thinking of adding inline-signing to dnssec-policy, do you think that would that be useful?

> Yes, from my point of view, that would surely be useful. I would very much welcome a configuration option within the dnssec-policy-statement, to globally enable inline-signing for all dnssec-signed zones.

If that's an option to preserve the unsigned zone files that will remain & retain that capability, then agreed -- a 'global' option within dnssec-policy, with option to override per-zone, would be useful in simplifying config.

bottom line:  i'd prefer to retain my flatfile/text unsigned/original zone data, and have bind create/push separate, signed data.


More information about the bind-users mailing list