[GH-ISSUE #214] DNSKEY query not returning RRSIG (or DNSKEY not being signed) #101

New issue

Closed

opened 2026-03-07 22:18:52 +03:00 by kerem · 1 comment

kerem commented

2026-03-07 22:18:52 +03:00

Owner

Originally created by @bluejekyll on GitHub (Sep 27, 2017).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/214

see #209 and #213

Originally created by @bluejekyll on GitHub (Sep 27, 2017). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/214 see #209 and #213

kerem

2026-03-07 22:18:52 +03:00

closed this issue
added the
bug

trust

crate:server
labels

kerem commented

2026-03-07 22:18:53 +03:00

Author

Owner

@bluejekyll commented on GitHub (Sep 28, 2017):

@TerraX-net, I remember now why this is happening. When building the signing and validation logic for DNSSec, I looked at this self-signed DNSKEY, and it didn't make sense to me to sign. This is because DNSKEY's are validated against DS records, making an RRSIG for the zone's DNSKEY irrelevant to the proof chain. I should be able to self-sign the DNSKEY without much issue.

This should be an easy fix. In #215 I plan to add tests for validating all the issues you've raised so far.

@bluejekyll commented on GitHub (Sep 28, 2017): @TerraX-net, I remember now why this is happening. When building the signing and validation logic for DNSSec, I looked at this self-signed DNSKEY, and it didn't make sense to me to sign. This is because DNSKEY's are validated against DS records, making an RRSIG for the zone's DNSKEY irrelevant to the proof chain. I should be able to self-sign the DNSKEY without much issue. This should be an easy fix. In #215 I plan to add tests for validating all the issues you've raised so far.

kerem referenced this issue

2026-03-15 22:04:59 +03:00

[GH-ISSUE #101] [Server] Add support for letsencrypt key signing #346