Lawrence K. Chen, P.Eng. <lkc...@ksu.edu> wrote: > On 2015-07-31 06:33, Tony Finch wrote: > > > > The DNSSEC records come from the zone data like any other records. You > > don't need any special DNSSEC configuration to act as a secondary for a > > signed zone - it just works. > > Is that the case now? I recall when I was initial deploying DNSSEC, DLV > required that all my nameservers respond the same. > > We use NSEC3 on our zones, but at the time our network operator's nameservers > didn't support NSEC3, so were absent from their responses. Had to delay until > they upgraded their servers (something about needing to upgrade from 5 to 6 > first), before we could go DNSSEC.
Yes, your secondaries need code to implement DNSSEC but they don't need any special DNSSEC configuration. Tony. -- f.anthony.n.finch <d...@dotat.at> http://dotat.at/ Viking, North Utsire, South Utsire: Southwesterly 4 or 5, backing southerly 5 or 6, occasionally 7 for a time in Viking and North Utsire. Slight or moderate, occasionally rough later in Viking. Rain later. Good, occasionally poor later. _______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users