My notes say that the hash is supposed to securely sent and stored in parent zone so what do I do after:

dnssec-keygen -a RSASHA256 -b 1024 -n ZONE mydomain.net
dnssec-keygen -a RSASHA256 -b 2048 -n ZONE -f KSK mydomain.net

dnssec-signzone -g -o mydomain.net -N increment -k Kmydomain.net.+008+27724 mydomain.net.rev Kmydomain.net.+008+26646
dnssec-signzone -g -o mydomain.net -N increment -k Kmydomain.net.+008+27724 mydomain.net.fwd Kmydomain.net.+008+26646

is there a command or do I get in contact with the parent domain administrator and ask them to include it?

  • As far as I know, the ways to automate this are still being discussed at IETF and that there's no widely adopted way, yet. – Pavel Šimerda Sep 22 '14 at 18:31
  • I imagine there is a huge security hurdle to overcome. Thanks for your help. – James Sterling Sep 22 '14 at 18:50

If your registrar supports DS records, you there should be a mechanism for adding it in their interface.

ICANN maintains a list of registrars that support DNSSEC, specifically including those that allow you to supply DS records.

All registrars will eventually be required to support DNSSEC, but in the mean time feel free to transfer your domain to one that does.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.