Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

named-checkzone is part of Bind, any other DNS validator should work

Is the signed zonefile in the right place? 

Code Block
languagebash
$ ls -al /var/lib/opendnssec/signed/example.com
-rw-r--r-- 1 opendnssec opendnssec 26783556 Dec 17 13:17 /var/lib/opendnssec/signed/uvt.nl


$ grep ^www /var/lib/opendnssec/signed/example.com
www.example.com.     3600    IN      A       12.34.56.78
www.example.com.     3600    IN      RRSIG   A 8 3 3600 20121226140702 20121212062213 60069 uvt.nl. dt4JWUe9IWhkk5pMI0M<ABBREVIATED>Im1quqhd1PH0KdLA1jTUhWB04YkRQZov/xsF0us=

If there is no file in that location either 'zonelist.xml' is wrong or the signer is not running. If there are no RRSIGs in the file you are probably looking at the unsigned file.

Is the DNS-server working?

Code Block
languagebash
$ dig +short www.example.com @mydnsserver
12.34.56.78

If this fails check if the nameserver is running at all.

 

Does the zone served match the zone on disk?

...

The SOA should be the same, if there is a difference, use the higher value

 

Does the DNSKEY served by DNS match the key stored in the HSM? 

...

There should be one active KSK. 

Have the signatures on the zone expired?

...

Preventing this situation is one of the primary purposes of OpenDNSSEC.  If this happens you should check that the OpenDNNSEC signer and validator are running. If they are running you should inspect the logs for problems.

 

There is not enough information in the logs

...

Code Block
languagebash
$ ods-signer verbosity 6

...

OpenDNSSEC doesn't seem to recogninze a zone while other zones work fine.  / Split-DNS doens't work.

...