title: How to add DNSSEC signed DS records in BIND?
body: <p>all (my english is not good sorry.)</p>
  
  <p>Let's begin...</p>
  
  <p>I created my own DNS Server use BIND9.</p>
  
  <p><strong>Installed:</strong> <em>bind bind-utils bind-chroot</em></p>
  
  <p>my server ip is (example IP): 123.456.789.123</p>
  
  <p>Everything works fine. (no cpu more 100%) but I keep got this error every day.</p>
  
  <pre><code>named[17203]: error (chase DS servers) resolving 'example.com/DS/IN': 123.456.789.123#53
  </code></pre>
  
  <p>I think it's mean it can not found DS records in my example.com.
  I try to search about this error and some people said I have to turn dnssec off but why?
  so, I try to find how to fix this error and I got some very good explaination sites here.</p>
  
  <p><a href="https://www.os3.nl/2011-2012/students/maikel_de_boer/cia/dnssec" rel="nofollow">https://www.os3.nl/2011-2012/students/maikel_de_boer/cia/dnssec</a></p>
  
  <p><a href="https://www.crc.id.au/configuring-dnssec-on-el6-and-bind-9/" rel="nofollow">https://www.crc.id.au/configuring-dnssec-on-el6-and-bind-9/</a></p>
  
  <p>I follow all the instruction from the sites above and it works! for me I got <strong>DNSSEC signed</strong>!
  and I got DNSKEY and RRSIG records.</p>
  
  <pre><code>zone example.com/IN/internal: loaded serial 31125225 (DNSSEC signed)
  </code></pre>
  
  <p>But I got the new problem! The new problem is.... when I use this command (sample)</p>
  
  <pre><code>dnssec-signzone -N INCREMENT example.com
  </code></pre>
  
  <p>It will create signed files look like this <strong>"example.com.signed"</strong> and <strong>"dsset-example.com."</strong></p>
  
  <p>In the file "dsset-example.com." have DS records for my example.com.
  But when I try to use the DS records inside "dsset-example.com." (Look like this)</p>
  
  <pre><code>example.com.       IN DS 64621 5 1 AFF...................FF
  example.com.       IN DS 64621 5 2 333EFBC.................5FC5 AG....54S
  </code></pre>
  
  <p>and insert into my "example.com.zone" file and when I try to (resign) dnssec-signzone again I got error message like this:</p>
  
  <pre><code>dnssec-signzone: fatal: 'example.com': found DS RRset without NS RRset
  </code></pre>
  
  <p>I don't know how to add the <strong>DS Records</strong> into the example.com.zone file with out dnssec-signzone error. 
  I think if I can do this the error message: <em>error (chase DS servers) resolving 'example.com/DS/IN'</em> may be gone.</p>
  
  <p>Do I have to create subdimain.example.com for DS records? I dont' know for sure. So, if you guys know how to fix this problem, please let me know.</p>
  
  <p>Thank you so much.</p>
  
  <p>my: /etc/named.conf</p>
  
  <pre><code>acl "trusted" {
          127.0.0.1;
          123.456.789.123;
  };
  
  options {
          listen-on port 53 { any; };
          listen-on-v6 port 53 { none; }; # I don't have IPv6
          directory       "/var/named";
          dump-file       "/var/named/data/cache_dump.db";
          statistics-file "/var/named/data/named_stats.txt";
          memstatistics-file "/var/named/data/named_mem_stats.txt";
  
          auth-nxdomain no;
          allow-query { localhost; any; };
          recursion no;
  
          dnssec-enable yes;
          dnssec-validation yes;
          dnssec-lookaside auto;
  
          /* Path to ISC DLV key */
          bindkeys-file "/etc/named.iscdlv.key";
  
          managed-keys-directory "/var/named/dynamic";
  
          check-names master ignore;
  };
  
  logging {
          channel default_debug {
                  file "data/named.run" size 5m;
                  severity dynamic;
                  print-time yes;
          };
  
          category default { default_debug; };
  };
  
  include "/etc/rndc.key";
  
  controls {
          inet 127.0.0.1 allow { localhost; }
          keys { "rndc-key"; };
  };
  
  view "localhost_resolver" {
          match-clients { localhost; };
          match-destinations { localhost; };
          recursion yes;
          empty-zones-enable yes;
  
          // all views must contain the root hints zone
          include "/etc/named.root.hints";
          include "/etc/named.rfc1912.zones";
  };
  
  view "internal" {
          match-clients { trusted; };     # match hosts in acl "trusted" above
          recursion yes;                  # allow recursive queries
          allow-recursion { trusted; };
          allow-transfer { trusted; };
          notify no;                      # disable AA notifies
          empty-zones-enable yes;
  
          // all views must contain the root hints zone
          include "/etc/named.root.hints";
          include "/etc/named.domains";
  };
  
  view "external" {
          match-clients { any; };
          recursion no;
          allow-transfer { none; };
  
          // all views must contain the root hints zone
          include "/etc/named.root.hints";
          include "/etc/named.domains";
  };
  </code></pre>
  
  <p>the file /etc/named.root.hints is:</p>
  
  <pre><code>// all views must contain the root hints zone
  zone "." IN {
          type hint;
          file "named.ca";
  };
  </code></pre>
  
  <p>my /etc/named.domains file:
  (Replaced with signed file "example.com.signed")</p>
  
  <pre><code>zone "example.com" IN {
          type master;
          file "example.com.signed";
          allow-update { none; };
  };
  </code></pre>
  
  <p>my example.com zone file (look like this):</p>
  
  <pre><code>$TTL    3h
  $ORIGIN example.com.
  @  1D                     IN SOA  ns1.example.com.    hostmaster.example.com. (
                                          2011051202      ; serial (d. adams)
                                          3H              ; refresh
                                          15M             ; retry
                                          1W              ; expiry
                                          1H )            ; minimum
  @  3600                   IN NS           ns1.example.com.
  ; Domain Keys
  default._domainkey        IN TXT         ( "v=DKIM1; k=rsa; "
                                             "p=A0GCSq................G/o+Q" )
  ; NS
  example.com.              IN NS           ns1.example.com.
  ; DNS Records
  example.com.              IN A            123.456.789.123
  localhost                 IN A            127.0.0.1
  ns1                       IN A            123.456.789.123
  www                       IN A            123.456.789.123
  ; DNSSEC KEY FROM Kexample.com.+....key
  example.com. IN DNSKEY 256 3 5 CH....................bYd+mARYse.................VCb
  example.com. IN DNSKEY 257 3 5 qX....................TYPDIsfso.................cEers
  </code></pre>
  
  <p>This one should have tag dnssec but this site need reputation more than 1500 to create a new tag. :(</p>