DNSSEC Setup on Authoritative BIND Server

This guide walks you through enabling DNSSEC on an authoritative BIND DNS server. You’ll generate signing keys, sign your zone, and configure BIND to serve the signed records. This protects your domain from DNS spoofing and cache poisoning. You’ll need root access to your BIND server and your zone file handy.

What You’ll Need

• A BIND 9.7 or later server (earlier versions lack native DNSSEC support)
• Root or sudo access to the server
• The zone file for the domain you want to sign
• Basic familiarity with BIND configuration and zone files

Step-by-Step

1. Back up your zone file. Copy the existing zone file to a safe location, e.g., cp /etc/bind/db.example.com /etc/bind/db.example.com.backup.
2. Generate the Key Signing Key (KSK). Run: dnssec-keygen -a RSASHA256 -b 2048 -f KSK -n ZONE example.com. This creates two files: Kexample.com.+008+XXXXX.key and the corresponding .private file. The KSK signs the DNSKEY record set.
3. Generate the Zone Signing Key (ZSK). Run: dnssec-keygen -a RSASHA256 -b 1024 -n ZONE example.com. The ZSK signs the actual zone data. Use a shorter key (1024 bits) for speed; the KSK provides the trust anchor.
4. Add the keys to your zone file. Append the contents of both .key files to your zone file. For example: cat Kexample.com.+008+*.key >> /etc/bind/db.example.com.
5. Configure BIND to sign the zone. In your named.conf (or the relevant zone definition), update the zone block to include dnssec-enable yes; and dnssec-validation yes; (the latter is for recursive servers, but good practice). Also add auto-dnssec maintain; and inline-signing yes; to allow BIND to automatically re-sign the zone when keys change.
6. Sign the zone. Run dnssec-signzone -A -3 $(head -c 16 /dev/urandom | od -An -tx1 | tr -d ' \n') -N INCREMENT -o example.com /etc/bind/db.example.com. This creates a signed zone file (default: db.example.com.signed). The -3 option adds NSEC3 hashing, -N INCREMENT sets the serial number to increment automatically.
7. Point BIND to the signed zone. In your zone definition, change the file directive to the signed file: file "/etc/bind/db.example.com.signed";.
8. Reload BIND. Run rndc reload or systemctl reload bind9 (depending on your distribution). Check for errors with journalctl -u bind9 or named-checkconf.
9. Verify the signature. Use dig +dnssec example.com SOA and dig +dnssec example.com DNSKEY. Look for the ad flag (authenticated data) and the RRSIG records in the output.
10. Publish the DS record. Obtain the DS record from the KSK: dnssec-dsfromkey Kexample.com.+008+XXXXX.key. Then log into your domain registrar and add this DS record to the parent zone (the TLD). This is the final step that makes DNSSEC work globally.

Common Mistakes

• Forgetting to update the serial number. If you don’t increment the serial, secondary servers won’t pick up the signed zone. The -N INCREMENT flag handles this, but if you sign manually, you must bump it.
• Using the wrong key type. The KSK must have the -f KSK flag. If you mix them up, the zone will still sign, but the trust chain breaks.
• Not publishing the DS record. Without the DS at the parent, resolvers will treat your zone as insecure. This is the most common reason DNSSEC appears to not work.
• Forgetting to enable DNSSEC in named.conf. Even if you sign the zone, BIND won’t serve the signatures unless dnssec-enable is set.
• Signing with an expired key. Keys have a validity period (default 30 days). If you don’t re-sign before expiry, your zone becomes bogus. Use auto-dnssec maintain to automate this.

Tips

• Use a longer KSK (2048 bits) for stronger security; the ZSK can be shorter (1024 bits) for performance.
• Keep your private keys offline if possible, especially the KSK. You can sign the zone on a separate machine and transfer the signed zone file.
• Set up monitoring for key expiry. Use dnssec-checkds or a cron job to alert you before keys rotate.
• Test with delv (a DNSSEC-aware dig) to validate your zone locally: delv @localhost example.com SOA.
• Consider using NSEC3 (the -3 flag) to prevent zone walking, but be aware it’s slightly more complex.

Troubleshooting

Zone fails to load: Check named-checkzone on the signed file. Look for errors like “no DNSKEY RR found” — you likely forgot to append the key files. Also check that the serial number is valid.

dig shows SERVFAIL: This often means the resolver can’t validate. Run dig +dnssec example.com SOA on the server itself. If it returns SERVFAIL, check your local trust anchor. If it works locally but not externally, the DS record is missing or incorrect at the parent.

RRSIG records missing: If you see the zone but no RRSIGs, BIND is serving the unsigned zone. Confirm you changed the file directive to the .signed file and reloaded.

Key not found: If dnssec-keygen fails, ensure the directory is writable and you have the right permissions. Also verify the zone name is correct (trailing dot matters).

Time skew: DNSSEC relies on accurate timestamps. If your server clock is off by more than a few minutes, signatures will be invalid. Run ntpdate or enable NTP.

Frequently Asked Questions

Do I need DNSSEC if I use HTTPS?

Yes. HTTPS encrypts data in transit but doesn’t prevent an attacker from redirecting your domain to a malicious IP. DNSSEC ensures the IP address you get is the one you published.

How often do I need to re-sign my zone?

With auto-dnssec maintain, BIND re-signs automatically before keys expire. If you sign manually, you must re-run dnssec-signzone at least before the signature lifetime ends (usually 30 days).

What’s the difference between KSK and ZSK?

The KSK signs the DNSKEY record set (which contains both keys). The ZSK signs all other records in the zone. The KSK is the trust anchor; the ZSK can be rotated more frequently without updating the parent.

Can I use ECDSA keys instead of RSA?

Yes, BIND supports ECDSA (e.g., -a ECDSAP256SHA256). It’s faster and produces smaller signatures, but not all resolvers support it yet. RSA is more universally compatible.

What happens if my DS record is wrong?

Resolvers will mark your zone as bogus, and clients will get SERVFAIL errors. Double-check the DS record with dnssec-dsfromkey and verify it matches what you entered at the registrar.

Will DNSSEC slow down my DNS?

Signing adds a small overhead (about 1-2% more CPU). The larger DNSKEY records and RRSIGs increase response size slightly, but the impact is negligible on modern hardware.

Related

• Gaming Mouse Button Mapping: Controls & Macros
• Email Phishing Protection: How to Secure Your Inbox
• DayZ Server: Set First or Third Person View