From 864c50297ef7af0edd602a1482ed856a5cf089a8 Mon Sep 17 00:00:00 2001 From: Peter Palfrader Date: Fri, 19 Feb 2010 19:22:10 +0100 Subject: [PATCH] DLV information --- input/howto/dns.mdwn | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/input/howto/dns.mdwn b/input/howto/dns.mdwn index 0591ccf..3ef8170 100644 --- a/input/howto/dns.mdwn +++ b/input/howto/dns.mdwn @@ -14,6 +14,8 @@ ssh://db.debian.org/git/geodomains.git and an entirely seperate workflow. At least it's consistent. +# DNSSEC + Adding DNSSEC KSK and ZSK for zones is done by running /srv/dns.debian.org/bin/maintkeydb with the following options: @@ -22,3 +24,16 @@ Adding DNSSEC KSK and ZSK for zones is done by running Use RSASHA1 instead of NSEC3RSASHA1 for IPv4 address space. After that a "; wzf: dnssec = 1" needs to be added to the zone file. + +## DLV + +In order to publish our trust anchors in the ISC DLV, add +"; dlv-submit = yes" to the zonefile, then run the dlv-submit-many script +in /org/dns.debian.org/dlv-sync. + +In order to authenticate our control of that zone to ISC you'll have to +manually add a DLV cookie to the respective zone. After adding it you either +need to wait a day or so for ISC to re-check by themselves (re-run the script +for status information) or trigger a re-check on their website. + +Once they have verified the cookie it can be removed from the zone again. -- 2.20.1