DNSSEC - How to Sign your .gov Zone

Much of the DNSSEC Documentation is based on NIST Special Publication 800-81 Rev 1 Secure Domain Name System Deployment Guide.
For reference, please read Download 800-81R1 PDF.

The first step to signing a DNS zone is to create the key signing key and the zone signing keys.
For background, read IETF Operational Procedures.

PREFERRED OPTION: NSEC3 Zone Signing (hashes child names to restrict enumeration)

dnssec-keygen -f KSK -a NSEC3RSASHA1 -b 2048 -n ZONE official.gov
dnssec-keygen -a NSEC3RSASHA1 -b 2048 -e -n ZONE official.gov
dnssec-keygen -a NSEC3RSASHA1 -b 2048 -e -n ZONE official.gov

When the commands finish, they will return a line like this for each keygen operation:

Kofficial.gov.+007+56487  (*This is the Key Signing Key because of the -f KSK option, trusted key)
Kofficial.gov.+007+62648
Kofficial.gov.+007+72348

OPTION B: NSEC Zone Signing - Less Secure, allows zone enumeration

dnssec-keygen -f KSK -a RSASHA1 -b 2048 -n ZONE official.gov
dnssec-keygen -a RSASHA1 -b 2048 -e -n ZONE official.gov
dnssec-keygen -a RSASHA1 -b 2048 -e -n ZONE official.gov

When the commands finish, they will return a line like this for each keygen operation:

Kofficial.gov.+005+56487  (*This is the Key Signing Key because of the -f KSK option, trusted key)
Kofficial.gov.+005+62648
Kofficial.gov.+005+72348

Note that two files are returned for each key created. Include the public key (with the .key extension) in the zone file. Also note that the KSK will be used to sign your zone file. The public KSK key will become the trusted key to validate official.gov. You should protect the private keys by keeping them offline and signing the zone offline.

Here is a sample zone file for the official.gov zone:

@ IN SOA ns1.official.gov dnsadm.official.gov. (
	2009010501    ; serial number (manually increment this number prior to each siging)
	10800         ; refresh period (3 hours)
	3600          ; retry refresh this often (1 hour)
	604800        ; expiration period (1 week)
	38400 )       ; minimum Time To Live (TTL) (10 hours 40 minutes)

@	IN NS   ns.official.gov.
ns     IN A    192.168.1.1
$include Kofficial.gov.+007+56487.key    ;key signing key
$include Kofficial.gov.+007+62648.key    ;zone signing key
$include Kofficial.gov.+007+72348.key    ;pre-published zone signing key

With the Option A keys included in the zonefile, we are ready to sign the zone with NSEC3 using the dnssec-signzone tool.

dnssec-signzone -a -N increment -H 10 -3 bbab -k Kofficial.gov.+007+56487 -o official.gov -e +7776000 official.gov Kofficial.gov.+007+62648

Or, with the Option B keys included in the zone file, we are ready to sign the zone with NSEC using the dnssec-signzone tool.

dnssec-signzone -a -N increment -k Kofficial.gov.+005+56487 -o official.gov -e +7776000 official.gov Kofficial.gov.+005+62648

The -o is not necessary if the zonename and filename are identical, but was added for clarity.

The signed zone, official.gov.signed, is the new zone file that should be present in named.conf:

zone "official.gov" {
     type master;
     file "official.gov.signed";
};

Next, we add the following command to the named.conf options statements:

options {
	...
	...	
        dnssec-enable yes;
};

Next, we restart your nameserver with the following command:

/etc/init.d/named restart

In our final step, we upload the auto-generated dsset-official.gov. file to www.dotgov.gov to enable Basic DNSSEC service.

Optionally, upload the auto-generated keyset-official.gov. to www.dotgov.gov to enable optional DNSSEC support.

Official.gov will need to be resigned whenever the zone is changed or prior to the signatures expiring.

KSK rollover will require new dssets to be uploaded into the dotgov system. Zones that have 'Opt-In' to the Optional Service will not need to upload keys or dssets to the www.dotgov.gov website after the initial upload. We recommend you roll your KSK by pre-publishing the new KSK in your zone at least TTL * 2 + 1 Day prior to signing the zone with the new KSK.

OPTIONAL OPT-IN: KSK rollover will occur automatically at the TLD when a new KSK is found in your zone. Remember to follow the KSK and ZSK pre-publishing instructions in NIST Special Pub 800-81 and publish BOTH KSKs during rollover to ensure continuation of validation by name servers. Failure to publish both KSKs may cause validation errors during rollover.