1

forward zone file:

$TTL 3600;

@ IN SOA ns1.sub.db.archives.net. hostmaster.sub.db.archives.net. (2014112100,4h,1h,7d,1h)

$ORIGIN dlv.isc.org. 
dlv.isc.org. IN DNSKEY 257 3 5 BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2 brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+ 1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5 ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt TDN0YUuWrBNh

$ORIGIN sub.db.archives.net
        IN  NS  ns1.sub.db.archives.net.
        IN  NS  ns1.db.archives.net.

ns1     IN  A   10.103.35.64
luke        IN  A   10.103.35.64
bo      IN  A   10.103.35.65
daisy       IN  A   10.103.35.66
sheriff     IN  A   10.103.35.67
boss        IN  A   10.103.35.68

dlv.sub.db.archives.net. 0 IN TXT "DLV:1:agnznsezdrch"

$INCLUDE Ksub.db.archives.net.+008+21243.key
$INCLUDE Ksub.db.archives.net.+008+23059.key

I sign the file with dnssec-signzone command:

dnssec-signzone -l dlv.isc.org -o sub.db.archives.net. -N increment -k Ksub.db.archives.net.+008+23059 sub.db.archives.net.fwd Ksub.db.archives.net.+008+21243

errors from service named start:

/etc/named/master/sub.db.archives.net.fwd.signed:79: ignoring out-of-zone data (dlv.isc.org)
...
zone sub.db.archives.net/IN: has no NS records
zone sub.db.archives.net/IN: not loaded due to errors.
_default/sub.db.archives.net./IN: bad zone
/etc/named/master/sub.db.archives.net.rev:11: ignoring out-of-zone data (dlv.isc.org)
/etc/named/master/sub.db.archives.net.rev:17: ignoring out-of-zone data (64.sub.db.archives.net)
/etc/named/master/sub.db.archives.net.rev:18: ignoring out-of-zone data 
...
dns_master_load: /etc/named/master/sub.db.archives.net.rev:24: Ksub.db.archives.net.+008+21243.key: file not found

I looked at my signed zone file:

boss.sub.db.archives.net.dlv.isc.org.   3600 IN A 10.103.35.68
...

No wonder it couldn't find the records. But I don't understand why this is happening. I also don't understand how it could be possible to validate a sub network with domain lookaside validation

I did try to validate, pretending the network was a subnetwork of dlv.isc.org, predictably it told be there were no records in the delegate zone.

How am I supposed to do this?

I was following the directions from https://dlv.isc.org/about/using

  • 1
    Aren't you missing a dot at the end of $ORIGIN sub.db.archives.net ? – wurtel Nov 24 '14 at 9:29
1

You're missing a dot at the end of the line

$ORIGIN sub.db.archives.net

This means that the previous origin is added to the end of that name.

Most "weird" errors in bind can be tracked back to a missing dot somewhere, that's always the first thing I look for when bind is doing unexpected things, after having been bitten by this a couple of times.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.