دروس الوحدة (1/3)
Firmare e pubblicare una zona
Signing and publishing a zone
Signing a zone produces DNSKEY and RRSIG data and, where required, denial-of-existence records. The published records, signatures, and DS in the parent must agree. A correct signature that expires before refresh can still cause validation failure.
Before enabling a DS, verify that the child serves the intended DNSKEY and valid signatures from every authoritative server. Check the parent DS digest against that key. Use a staged change, confirm answers through independent validating resolvers, and keep a documented recovery path. Protect private keys and limit access to signing systems.
DNSSEC operations are distributed: publication, TTLs, caches, and registrar changes do not update everywhere at one instant. Verify each stage before moving to the next.
Check your understanding
Choose the best answer. This quiz runs locally and sends no DNS queries to real domains.
What should you check before publishing a DS in the parent?