Hi all, reading about the various ways to sign zones, inline-signing seems to be the simplest one. However, a 2014 Swiss howto I found has this obscure warning:
Update Nov 2017: DNSSEC zone signing as described here is outdated. We strongly recommend against the method described in this blog post. Newer BIND versions or other DNS software have greatly simplified DNSSEC signing. https://securityblog.switch.ch/2014/11/13/dnssec-signing-your-domain-with-bind-inline-signing/ The (old) text has inline signing exemplified like so: zone example.com { type master; file "/etc/bind/zones/db.example.com”; # publish and activate dnssec keys auto-dnssec maintain; # use inline signing inline-signing yes; }; Did a better way arrive between 2014 and 2017? What does that warning mean? Thank you Ale -- _______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users