Sign and Verify the Zone file

Sign and Verify Zone Files with RSA Keys

1. Perform zone signing.

/usr/local/bin/dnssec-signzone -S -o example.net /var/named/example.net

Zone signing

2. This generates the example.net.signed file. A DS record file will be automatically generated.

DS records files generated

3. Verify the signed zone file. The signed zone file verification is done using the dnssec-verify command.

/usr/local/bin/dnssec-verify -z -o example.net /var/named/example.net.signed Kexample.net.+008+44141.key Kexample.net.+008+22449.key

Zone verification for RSA key

Where Kexample.net.+008+44141.key is the key file generated for the ksk key and Kexample.net.+008+22449.key is the key file generated for the zsk key.

Sign and Verify Zone Files with ECC Keys

1. Use the dnssec-signzone command below to perform zone signing.

/usr/local/bin/dnssec-signzone -S -z -o exampleecc.net /var/named/exampleecc.net

Zone signing for ECC key

This generates the exampleecc.net.signed file. A DS record file will be automatically generated.

DS record file details

2. Verify the signed zone file.

/usr/local/bin/dnssec-verify -z -o exampleecc.net /var/named/exampleecc.net.signed Kexampleecc.net.+013+15983.key Kexampleecc.net.+013+23348.key

Zone verification for ECC key