Hi Libor, Thanks for your fast reply! It helps somewhat, but not all the way. Is there any way I can do this remotely? I would like to add/del additional non-signing keys from a central control unit. Next step is to import CDS/CDNSKEY records. It seems dynamic updates don’t like these either. Can I dynamically add CSYNC?
/Ulrich > On 16 Feb 2021, at 18:49, libor.peltan <[email protected]> wrote: > > Hi Ulrich, > > thank you for reporting your difficulties. > > Well, DDNS provides an ability to modify zone records, but not signing keys. > Even if the update of DNSKEY record wasn't prohibited through DDNS, it won't > help you much, because the DNSKEY RRset is in full control of signing > routines. Knot indeed doesn't "like" DDNS of even RRSIG and NSEC records, etc. > > My recommendations will differ depending on what you are actually trying to > achieve. > > If you want to add another ZSK that will be used for signing, you need to > import it into the KASP db, with its public and private part and appropriate > metadata (mostly timers). > > If you want to add a ZSK, that will reside in the DNSKEY RRset, but not used > for signing the zone, you need to import it as "public only", with its public > part and metadata. > > Both can be done with the keymgr utility and its `import-bind`, `import-pub`, > `import-pem` functions. See > https://www.knot-dns.cz/docs/3.0/singlehtml/index.html#document-man_keymgr > > Either way, the DNSKEY RRset in the zone will be updated as part of following > signing process. > > I hope this helps you, > > Libor > > Dne 16. 02. 21 v 18:25 Ulrich Wisser napsal(a): >> Hi! >> >> Today we tried to do a dynamic update to the dnskey set. >> >> What we want to do is to import the ZSK from another signer. >> >> Didn’t work so well. >> >> Feb 16 17:15:28 ip-172-31-38-41 knotd[24222]: warning: DDNS, refusing to >> update DNSSEC-related record >> >> I guess knot doesn’t like dynamic DNSSEC updates. >> I even tried with policy manual:on. >> >> What does one have to do to be allowed to add (or delete) DNSKEY records? >> >> /Ulrich >> -- https://lists.nic.cz/mailman/listinfo/knot-dns-users
