Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Just trying to understand the bindkeys-file directive related to the DNSSEC extension in the Bind configuration. Is that a public key? Does it sign the response in the same way as digital signatures?

share|improve this question
Please do not use code markup to highlight words, only for code. You don't need to highlight words in every sentence. – Gilles Jun 24 '14 at 23:17

It’s actually an alternative repository for trusted keys, where one can submit their zone keys, if there is no fully signed path from root zone down to your own zone. The functional DLV registry is dlv.isc.org. By default the root zone key and the dlv.isc.org key are included in /etc/named.iscdlv.key and that goes as a value to bindkeys-file attribute in Options directive. you can find this automatically in named.conf or named.options.

from /usr/share/doc/bind-9.7.3/arm/Bv9ARM.pdf:

bindkeys-file The pathname of a file to override the built-in trusted keys provided by named. See the discussion of dnssec-lookaside and dnssec-validation for details. If not specified, the default is /etc/bind.keys.

share|improve this answer
I will read that PDF later, answer upvoted – Ask and Learn Jun 24 '14 at 12:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.