Migrating to BIND9 dnssec-policy

https://dotat.at/@/2024-05-11-dnssec-policy.html

Here are some notes on migrating a signed zone from BIND's old auto-dnssec to its new dnssec-policy.

I have been procrastinating this migration for years, and I avoided learning anything much about dnssec-policy until this month. I'm writing this from the perspective of a DNS operator rather than a BIND hacker.

( Read more... )