Home / server / Questions / 745270
Accepted
hardillb
Asked: 2015-12-26 10:37:42 +0800 CST

Using DNSSEC with private TLD

  • 772

I'm playing with DNSSEC for my domain, my DNS server is dual homed (with suitable limits on what can be queried on the public interface) and covers both my public domain, but also a private top level domain (.loc) that I use on my LAN.

I'm struggling to work out how to add a DS record for the .loc domain into my bind9 config. Because it is a Top Level Domain it would normally be listed root servers.

Can I add it to my zone file before the $ORIGIN statement?

bind

1 Answers

  1. Best Answer

    You can't really add a DS record for something that is not part of the tree, as there is no proper parent/child relationship for such a zone.

    It should be possible to use trusted-keys on your internal validating resolvers to override the keys (or lack thereof) specified in DNS.

    It's worth noting, however, that just picking an arbitrary TLD and using it internally is not a good practice. Especially so nowadays as the flood-gates have been opened and new public TLDs are registered all the time.

    • 4