[Opendnssec-user] OpenDNSSEC in a hidden master setup

Roman Serbski mefystofel at gmail.com
Tue Aug 26 08:08:40 UTC 2014


I'm sorry for a dumb question (I've just started working with OpenDNSSEC),
but in the following setup with three servers involved:

[Hidden master] <---> [OpenDNSSEC] <---> [Public slave]

do I need to run "traditional" DNS server on the OpenDNSSEC box to deal
with signed zones transfers to the slave?

I think I have a problem with getting the zone from the hidden master as
soon as I increase the serial.

All three servers are running FreeBSD 10-STABLE, with the latest NSD
(4.0.3) installed on the hidden master and the slave.  OpenDNSSEC box
(version 1.4.6) doesn't have NSD installed.

My plan is to feed plain zones to OpenDNSSEC, sign them and transfer to the

Here is the snippet from nsd.conf from the hidden master ( is
the IP of OpenDNSSEC):

        name: "plain-to-signer"
        zonefile: "zones/%s"
        notify: tsig.sha256.signed
        provide-xfr: tsig.sha256.signed

        name: "domain.org"
        include-pattern: "plain-to-signer"

OpenDNSSEC configs:

addns.xml ( is the hidden master and is the





conf.xml is the default one, with one modification:


kasp.xml is the default one (I'm using default policy), with one change:



<Zone name="domain.org">
<Adapter type="DNS">/usr/local/etc/opendnssec/addns.xml</Adapter>
<Adapter type="DNS">/usr/local/etc/opendnssec/addns.xml</Adapter>

If I increase the serial, reload the zone on hidden master and do
ods-control stop/start on the OpenDNSSEC I see that the signed zone was
successfully transferred to the slave. Here is the log from the slave:

[1408994435] nsd[1404]: info: notify for domain.org. from
[1408994435] nsd[1364]: info: xfrd: zone domain.org committed "received
update to serial 2014082512 at 2014-08-25T21:20:35 from TSIG
verified with key tsig.sha256.signed"
[1408994435] nsd[1480]: info: rehash of zone domain.org. with parameters 1
0 5 e99189ffbae225cf
[1408994435] nsd[1480]: info: zone domain.org. received update to serial
2014082512 at 2014-08-25T21:20:35 from TSIG verified with
key tsig.sha256.signed of 3566 bytes in 0.000139 seconds
[1408994435] nsd[1364]: info: Zone domain.org serial 2014082509 is updated
to 2014082512.

But if I just increase the serial and reload the zone on hidden master, I
get the following in the logs of OpenDNSSEC:

Aug 26 09:20:40 ns-sign ods-signerd: [xfrd] zone domain.org request
udp/ixfr=2014082511 to

and nothing happens after that. I see no errors on the hidden master or

Any hints would be greatly appreciated.

Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opendnssec.org/pipermail/opendnssec-user/attachments/20140826/1932787f/attachment.htm>

More information about the Opendnssec-user mailing list