Quelltext der Seite Pseudo second level domain von Basics zu DNSEC

==Trust Anker einfügen==
*cd /etc/bind/
*wget http://192.168.X.88/trust-anchors.conf
*echo 'include "/etc/bind/trust-anchors.conf";' >> named.conf
==/etc/bind/named.conf.options==
===Berechtigungen und Einschränkungen===
<pre>
options {
  directory "/var/cache/bind";
  forwarders { <DNSGW>; };
  allow-query { 0.0.0.0/0; };
  allow-recursion { 10.88.2XX.0/24; 172.26.2XX.0/24; 10.2XX.1.0/24; 172.20.2XX.0; 127.0.0.1; };
  allow-transfer {127.0.0.1; };
  dnssec-validation yes;
  empty-zones-enable no;
  listen-on-v6 { none; };
  listen-on { any; };
};
</pre>
==/etc/bind/named.conf.local==
<pre>
 //Standardmässig leer
 //Hier werden die sogenanten Zonen angelegt.
 zone "it2XX.int" {
        type master;
        file "it2XX.int.signed";
        };
  zone "2XX.88.10.in-addr.arpa" {
        type master;
        file "2XX.88.10.in-addr.arpa";
      };
</pre>
=DNSSEC Schlüssel erzeugen=

;Forward Zone
*dnssec-keygen -a RSASHA256 -b 2048 -n ZONE it2XX.int
*dnssec-keygen -a RSASHA256 -b 4096 -f KSK -n ZONE it2XX.int
=DNSKEY einbinden=

;Forward
*for k in Kit2XX.int.+*.key ; do echo "\$INCLUDE $k" >> /var/cache/bind/it2XX.int; done

=Zonen signieren=

*dnssec-signzone -A -N INCREMENT -o it2XX.int -t /var/cache/bind/it2XX.int

;Erzeugt
<pre>
/var/cache/bind/it2XX.int.signed
</pre>

*systemctl restart named