dnssec revision 5b4397d387b89d696b5eb90c328a385e07d4a380
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterCopyright (C) 2000 Internet Software Consortium.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterSee COPYRIGHT in the source root or http://www.isc.org/copyright for terms.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterDNSSEC Release Notes
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterThis document summarizes the state of the DNSSEC implementation in
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterthis release of BIND9.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterKey generation and signing
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterThe tools for generating DNSSEC keys and signatures are now in the
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterbin/dnssec directory. Documentation for these programs can be found
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterin doc/arm/Bv9ARM.4.html and the man pages.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterThe random data used in generating DNSSEC keys and signatures comes from
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fostereither /dev/random (if the OS supports it) or keyboard input. Alternatively,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterthe a device or file containing entropy/random data can be specified.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterServing secure zones
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterWhen acting as an authoritative name server, BIND9 includes KEY, SIG
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterand NXT records in responses as specified in RFC2535.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterResponse generation for wildcard records in secure zones is not fully
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fostersupported. Responses indicating the nonexistence of a name include a
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterNXT record proving the nonexistence of the name itself, but do not
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterinclude any NXT records to prove the nonexistence of a matching
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterwildcard record. Positive responses resulting from wildcard expansion
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterdo not include the NXT records to prove the nonexistence of a
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosternon-wildcard match or a more specific wildcard match.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterSecure resolution
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterBasic support for validation of DNSSEC signatures in responses has
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterbeen implemented but should still be considered experimental.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterWhen acting as a caching name server, BIND9 is capable of performing
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterbasic DNSSEC validation of positive as well as nonexistence responses.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterThis functionality is enabled by including a "trusted-keys" clause
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterin the configuration file, containing the top-level zone key of the
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterthe DNSSEC tree.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterValidation of wildcard responses is not currently supported. In
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterparticular, a "name does not exist" response will validate
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fostersuccessfully even if it does not contain the NXT records to prove the
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosternonexistence of a matching wildcard.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterProof of insecure status for insecure zones delegated from secure
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterzones works when the zones are completely insecure. Privately
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fostersecured zones delegated from secure zones will not work in all cases,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fostersuch as when the privately secured zone is served by the same server
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosteras an ancestor (but not parent) zone.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterHandling of the CD bit in queries is not yet fully implemented;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fostervalidation is currently attempted for all recursive queries, even if
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterSecure dynamic update
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan FosterDynamic update of secure zones has been implemented, but may not be
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fostercomplete. Affected NXT and SIG records are updated by the server when
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosteran update occurs. Advanced access control is possible using the
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster"update-policy" statement in the zone definition.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster$Id: dnssec,v 1.6 2000/07/14 00:03:54 bwelling Exp $