DNSSEC: how are DS records supposed to be transferred and end up in parent zone?

Question

My notes say that the hash is supposed to securely sent and stored in parent zone so what do I do after:

dnssec-keygen -a RSASHA256 -b 1024 -n ZONE mydomain.net
dnssec-keygen -a RSASHA256 -b 2048 -n ZONE -f KSK mydomain.net

dnssec-signzone -g -o mydomain.net -N increment -k Kmydomain.net.+008+27724 mydomain.net.rev Kmydomain.net.+008+26646
dnssec-signzone -g -o mydomain.net -N increment -k Kmydomain.net.+008+27724 mydomain.net.fwd Kmydomain.net.+008+26646

is there a command or do I get in contact with the parent domain administrator and ask them to include it?

As far as I know, the ways to automate this are still being discussed at IETF and that there's no widely adopted way, yet. — Pavel Šimerda, Sep 22 '14 at 18:31
I imagine there is a huge security hurdle to overcome. Thanks for your help. — James Sterling, Sep 22 '14 at 18:50

score 3 · Accepted Answer · answered Sep 24 '14 at 03:50

If your registrar supports DS records, you there should be a mechanism for adding it in their interface.

ICANN maintains a list of registrars that support DNSSEC, specifically including those that allow you to supply DS records.

All registrars will eventually be required to support DNSSEC, but in the mean time feel free to transfer your domain to one that does.

DNSSEC: how are DS records supposed to be transferred and end up in parent zone?

1 Answers1