Re: bin/52465 (/etc/namedb/bind.keys did not updated)

["Kimmo Suominen via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR bin/52465; it has been noted by GNATS.

From: Kimmo Suominen <kim%netbsd.org@localhost>
To: gnats-bugs%netbsd.org@localhost
Cc: 
Subject: Re: bin/52465 (/etc/namedb/bind.keys did not updated)
Date: Mon, 26 Oct 2026 11:35:31 +0200

 On Mon, Oct 26, 2026 at 03:17:11AM +0000, riastradh%NetBSD.org@localhost wrote:
 > This is not fixed until we have:
 > (a) eliminated all duplicate copies of bind.keys in the source tree, and
 > (b) determined it is sensible to be shipping /etc/named/bind.keys at all.
 
 The BIND version in -current as of today is 9.20.30, and in -11 from
 20261009152657Z it is 9.20.24.  The default value for dnssec-validation
 in 9.20 is "auto".  The default value for bindkeys-file is empty, and
 its intended purpose is server testing.
 
 The default value of dnssec-validation ("auto") works for the general
 use case of Internet-connected resolving name servers.  A builtin root
 DNSSEC key is used and RFC 5011 is followed for root key rollovers.
 Once the builtin key becomes too old, the operator is expected to
 install a more recent release of BIND.  The "too old" scenario only
 applies to fresh server installs.
 
 The bind.keys file is no longer read (unless explicitly configured with
 bindkeys-file).  It was read by version 9.18, but not by 9.20.
 
 In a lab or other isolated environment DNSSEC is expected to be enabled
 using "dnssec-validation yes" together with trust-anchors in named.conf.
 
 In my understanding there is no need to install a bind.keys file for the
 server in /etc/namedb (or elsewhere).  The BIND distribution does not
 install it.
 
 The source still comes with a bind.keys file and it is the source file
 for the bind.keys.h header file during the build.
 
 References:
 - https://bind9.readthedocs.io/en/v9.20.30/reference.html#namedconf-statement-dnssec-validation
 - https://bind9.readthedocs.io/en/v9.20.30/reference.html#namedconf-statement-bindkeys-file
 - https://bind9.readthedocs.io/en/v9.20.30/reference.html#namedconf-statement-trust-anchors
 
 Kind regards,
 + Kimmo