DNSSEC on hostname

[Wanabo]

Following this DA-tutorial, I've managed to setup DNSSEC for a "normal" domain. All checks out well at dnssec-debugger.verisignlabs.com.

Is the procedure the same for the hostname?
I'm unsure because in :2222/evo/admin/dns I have two dns entries. One for host.example.com and one for example.com. Nameservers for all hosted domains are ns1.example.com and ns2.example.com
Should I generate dnssec keys for both domains?

I mean, when I do something wrong it could negatively impact on mail- and domain trust.

 

[Richard G]

Should I generate dnssec keys for both domains?

That's up to you if you want that.
I've read a little bit about it on Cloudflare (click) and if you have setup the hostname the same was as in my guide so as seperate DNS record, then you do have seperate DNS like as in a subdomain.
Also in that DNS record you are able to create DNSSEC keys for that "subdomain" since it's a seperate DNS record.
It's also possible to have the hostname record on one server and the domain record on another server, which would also have seperate/different DNS entries.

So reading that part and since it's a separate DNS record I think it is possible, as a choice, because it's not requirement.

 

[Wanabo]

I think I have to ask my domain registrar if he can assign keys to host.example.com and example.com. If that is the case than I think my question is answered.

 

[Driesp]

Hi Wanabo

You should delete the subdomain zone 'host.example.com' and add the required DNS records in the parent zone or it will create issues.
You should only sign the parent zone.
(unless you know what you are doing, but still, you should not do it that way)

Our DirectAdmin servers are primary dns servers notifying an inline signer which is notifying our authoritative servers.
In this way, all zones are by default signed with the dnssec protocol we want. Users on DirectAdmin or DirectAdmin administrators cannot change anything about DNSSEC (enable or disable it, change the protocol or other dnssec settings), this is the way we want it to be implemented.
Our inline signer is filtering out subdomains, and other zones like 'localhost' and 'localhost.localdomain' or domains that do not have a tld,...

Kr
Dries

 

[Wanabo]

You should delete the subdomain zone 'host.example.com' and add the required DNS records in the parent zone or it will create issues.
You should only sign the parent zone.

When I check mail headers I see: Received:from host.example.com by host.example.com with LMTP id +.......
Would this behavior change and break something when deleting the subdomain zone 'host.example.com' and add the required DNS records in the parent zone?
And what about 2222/evo/admin/server-tls. It has server TLS certificate and key for host.example.com.

 

[Driesp]

I don't think it will, you will have to make sure the required subdomain records are active in the parent zone.

Kr
Dries

 

[Wanabo]

Ok, it's clear to me what steps I need to do then if I follow your quide. Thanks, but I believe there is an other way. Both could be valid off course.
I've got this link from my domain registrar, dnssec-automate-adding-subdomain-s-ds-and-ns-records-to-parent-zone. I understand that with

dnssec_add_subdomain_ds_to_parent=1

I'm all good.

Found another thread, dnssec-for-fully-qualified-subdomains.49651/page-2, where user @ditto had similar concerns like me.

 

[Richard G]

don't think it will,

I think it does unless you know what you're doing. Because you won't get an SSL record for your hostname, unless you either use wildcard DNS or add the hostname sub in the directadmin.conf like you would do when adding imap (which is also not a real subdomain).

Also we've seen issues with mail send via php mail via the hostname causing odd issues, which is the reason we create a seperate DNS entry for the hostname. Reason: without it, there is no entry for the hostname in the /etc/virtual directory which could cause issues.
Those are my concerns, seen that happening in the past which is why I never again use the hostname in the normale domain dns.

So with the line written by Wanabo I also think he's fine, which is easy to check.