Stephane, On Oct 23, 2008, at 2:16 AM, Stephane Bortzmeyer wrote:
Why should these be in the DLV ? Because, otherwise, how could I validate domains under ".br" and ".cz"?
IANA is planning on announcing the beta version of the IANA interim trust anchor repository during the upcoming RIPE meeting. This TAR uses the established trust relationships to obtain the trust anchors and publishes those trust anchors via an X.509 protected web site.
This does not scale.
True, however it does scale for TLDs.
What is a proper configuration? My BIND has:
dnssec-enable yes; dnssec-lookaside . trust-anchor dlv.isc.org.; dnssec-validation yes;
I've always been curious why there are two binary switches for turning on DNSSEC in BIND (particularly since BIND always sets "DNSSEC OK", regardless of whether those switches are true or any trust anchors have been configured), but that's not your issue...
include "/etc/bind/trust-anchors"; // A few DNSKEY for domains // I was able to check personnally
Better suggestions are welcome.
FWIW, on my laptop, I have a really simple cronjob that fetches the root zone trust anchor from IANA's testbed and HUPs the server. However, I won't actually care about the ITAR itself, since I slave the root zone on my laptop and the IANA DNSSEC testbed root zone has all the TLD trust anchors to date and will continue to do so. The ITAR could, of course be fetched instead of the root zone trust anchor if you don't happen to trust IANA's generation of the root zone in its DNSSEC testbed. Regards, -drc