2

I have created DNSSEC records for my domain using an old guide from serverfault.com [ https://serverfault.com/questions/405528/basic-dnssec-configuration-under-bind-9-7 ] and I would now like to add my DNSSEC details to my domain registrar's records, but I am a bit stuck on what to put where in their table.

Keytag: I have a keyid in my public key file, so would this be it?

Algorithm: I know this to be 5.

Digest Type: I know this to be RSASHA1.

Digest: Not sure: I have tested various strings from the files, where I could be sure that the strings were public, not private, but I keep on seeing the same error: ERROR: Parameter value range error

Can anyone enlighten me on this, please?

...

Ready for Confusion link: http://www.rfc-editor.org/rfc/rfc4034.txt

1 Answers1

5

Depending on registry, the information you need to provide will exactly correspond to either a DNSKEY record (for .eu) or to a DS record (most other registries). Since you're being asked for a "digest", that means DS.

That means you can short-circuit this by skipping to the "Digest" section below, generating a DS record from your key (or zone), and copy/pasting all the fields straight from it.

The individual fields are:

Key tag: Same as keyid. DS records have a key tag that's a 5-digit (or sometimes 4-digit; generally 16-bit) number (based on a hash of the whole key). If your generated key files were named Kexample.com.+005+12345.key, the key tag is 12345. It will be shown in the dnssec-dsfromkey output too.

Algorithm: In your zone it's 5 for RSASHA1.

Digest Type: That's definitely not RSASHA1. It could be either 1 for SHA1 or 2 for SHA256, but it doesn't depend on the zone itself: it just indicates what sort of hash you'll be giving in the following field. It's common to add DS records with both hash types for the same key.

Digest: This cannot be taken directly from your key files; it can be generated from them, using such tools as dnssec-dsfromkey or ldns-key2ds:

$ dnssec-dsfromkey Kexample.com+005+12345.key

$ dig example.com. dnskey @::1 | dnssec-dsfromkey -A -f - example.com.

(The -A flag is needed because you don't have any ZSKs, i.e. keys with the SEP flag set. While technically valid, this can cause much annoyance due to tools skipping non-SEP keys.)

By default the command will show two DS records using different hashes; you can add both or whichever you want. If you chose RSASHA1 because you aim for best compatibility (which I'd believe if you supported IPv4), then you should include the SHA1 DS record as well. Otherwise, SHA256 is also widely supported already.

grawity
  • 501,077