dnssec revision 9dc499f133042bb8ab6e2089db708be0d13733bf
8af80418ba1ec431c8027fa9668e5678658d3611Allan FosterDNSSEC Release Notes
8af80418ba1ec431c8027fa9668e5678658d3611Allan FosterThis document summarizes the state of the DNSSEC implementation in
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterthis release of BIND9.
8af80418ba1ec431c8027fa9668e5678658d3611Allan FosterKey generation and signing
8af80418ba1ec431c8027fa9668e5678658d3611Allan FosterThe tools for generating DNSSEC keys and signatures are now in the
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterbin/dnssec directory. Documentation for these programs can be found
8af80418ba1ec431c8027fa9668e5678658d3611Allan FosterThe random data used in generating DNSSEC keys and signatures comes from
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster/dev/random if the OS supports that. Otherwise, the DNSSEC tools must
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterbe fed a file containing entropy/random data. Future releases will allow
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterentropy to be entered manually from the keyboard.
8af80418ba1ec431c8027fa9668e5678658d3611Allan FosterServing secure zones
8af80418ba1ec431c8027fa9668e5678658d3611Allan FosterWhen acting as an authoritative name server, BIND9 includes KEY, SIG
a4544a5a0e622ef69e38641f87ab1b5685e05911Phill Cunningtonand NXT records in responses as specified in RFC2535.
a4544a5a0e622ef69e38641f87ab1b5685e05911Phill CunningtonResponse generation for wildcard records in secure zones is not fully
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fostersupported. Responses indicating the nonexistence of a name include a
8af80418ba1ec431c8027fa9668e5678658d3611Allan FosterNXT record proving the nonexistence of the name itself, but do not
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterinclude any NXT records to prove the nonexistence of a matching
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterwildcard record. Positive responses resulting from wildcard expansion