[Opendnssec-user] Guidance on Chained Zone Validation

[Mark Elkins]

(Someone here must have done this)

I've got the zones..

ZA
/ | \
org co web(.za)

All sign just fine. My own checking tool plus tools like dnssec-verify
and validns pass the individual zones just fine. My copy of the ZA zone
also contains the DS records of my children.

I'd like to somehow test the signature chain down from my ZA Zones
DNSKEY (Trust Anchor) to the SOA of one of the second levels - or even
the SOA of a child of one of the second levels.

How could I do this?
Going "live" is not yet an option.

Setting up a separate DNSSEC aware resolver and adding my ZA Trust
Anchor is an easy first step. Not sure after that.
Using BIND, would things like stub records be the way to go?

[Erwin Lansing]

Post by Mark Elkins
(Someone here must have done this)
I've got the zones..
ZA
/ | \
org co web(.za)
All sign just fine. My own checking tool plus tools like dnssec-verify
and validns pass the individual zones just fine. My copy of the ZA zone
also contains the DS records of my children.
I'd like to somehow test the signature chain down from my ZA Zones
DNSKEY (Trust Anchor) to the SOA of one of the second levels - or even
the SOA of a child of one of the second levels.
How could I do this?
Going "live" is not yet an option.

I think what you’re looking for is a pre-delated domain check in zonemaster. You can point to your test server, but have it evaluate as if it were already live.

https://zonemaster.net

Erwin