X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=input%2Fhowto%2Fdns.mdwn;h=3ef81709de9656c6f7cefcd22f7ba26a7c8c736d;hb=cd2c6fceca5264491e0506f516667d5b1b64b903;hp=0591ccf3216805e627cd68932410e5928d7a69c4;hpb=3ffe6f21540a5869803d6e4da6e8c7e67b796f14;p=mirror%2Fdsa-wiki.git

diff --git a/input/howto/dns.mdwn b/input/howto/dns.mdwn
index 0591ccf..3ef8170 100644
--- a/input/howto/dns.mdwn
+++ b/input/howto/dns.mdwn
@@ -14,6 +14,8 @@ ssh://db.debian.org/git/geodomains.git and an entirely seperate workflow.
 
 At least it's consistent.
 
+# DNSSEC
+
 Adding DNSSEC KSK and ZSK for zones is done by running
 /srv/dns.debian.org/bin/maintkeydb with the following options:
 
@@ -22,3 +24,16 @@ Adding DNSSEC KSK and ZSK for zones is done by running
 Use RSASHA1 instead of NSEC3RSASHA1 for IPv4 address space.
 
 After that a "; wzf: dnssec = 1" needs to be added to the zone file.
+
+## DLV
+
+In order to publish our trust anchors in the ISC DLV, add
+"; dlv-submit = yes" to the zonefile, then run the dlv-submit-many script
+in /org/dns.debian.org/dlv-sync.
+
+In order to authenticate our control of that zone to ISC you'll have to
+manually add a DLV cookie to the respective zone.  After adding it you either
+need to wait a day or so for ISC to re-check by themselves (re-run the script
+for status information) or trigger a re-check on their website.
+
+Once they have verified the cookie it can be removed from the zone again.