Just trying to understand the
bindkeys-file directive related to the DNSSEC extension in the Bind configuration. Is that a public key? Does it sign the response in the same way as digital signatures?
It’s actually an alternative repository for trusted keys, where one can submit their zone keys, if there is no fully signed path from root zone down to your own zone. The functional DLV registry is
dlv.isc.org. By default the root zone key and the
dlv.isc.org key are included in
/etc/named.iscdlv.key and that goes as a value to
bindkeys-file attribute in Options directive. you can find this automatically in
bindkeys-file The pathname of a file to override the built-in trusted keys provided by named. See the discussion of dnssec-lookaside and dnssec-validation for details. If not specified, the default is /etc/bind.keys.