DNSSEC Lab

While DNSSEC is a extremely complex topic, this lab tends to make use of PowerDNS online singning method with PowerDNS admin web UI. At this point we already have primary & secondary servers running with zone replication as well as (support for) DNSSEC enabled.

All left to make use of DNSSEC is to sign our zone and provide the DS records to the upper zone (learndns.info).

In PowerDNS admin panel, click on the “red open lock” next to the domain under DNSSEC section and select “Enable”

This should now show a closed lock to your domain. This means domain is now sigend.

Normally this step is done at registrar level for a full fledged domain. But since lab is based on sub-zones under the main zone - learndns.info, you need to provide your DS records to lab instructor who will add these at the learndns.info zone.

Click on green lock to view DS records:

You can ignore the first record and simply provider the 2nd and 3rd record. You can upload DS records from here. **Be careful in copy pasting to ensure complelete record has been selected before copying. There is a invisible horizontal scrolling on it.

Checkout Verisign Labs or DNSViz tool, enter your domain e.g domain01.learndns.info and verify that there are no errors. Output should like this: