Re: [nznog] DNSSEC single point of failure?

On Sun, 24 Aug 2014 09:56:59 Jay Daley wrote:

On 24/08/2014, at 9:23 am, Jean-Francois Pirus wrote:

...

On Sun, 24 Aug 2014 09:12:26 Jay Daley wrote:

...

Is there any particular reason you are using DLV and not ordinary root DNSSEC?

I'm just using the default dnssec config for Bind 9.8 on RHEL 6, under the assumption that the defaults would be safe.

As sebastian says, no need for DLV. Remove the line

dnssec-lookaside auto

I'll do that. Thanks. A bit of a gotcha I though people should be aware of.

Jay

-- Jean-Francois Pirus | Technical Manager francois(a)clearfield.com | Mob +64 21 640 779 | DDI +64 9 282 3401 Clearfield Software Ltd | Ph +64 9 358 2081 | www.clearfield.com