Webmin: DNSSEC No RRSIGs found

[SavageCore]

I've used the BIND module in Webmin to create and sign zone which all completed successfully. However the debugger at Verisign reports No RRSIGs found.

BIND 9.9.4
Webmin 1.780
Fedora 20

[jcameron]

If you check your zone file, are there any RRSIG records?

[SavageCore]

Yes both the master and slave have RRSIG records. Totally lost.. The domain I'm testing with is your-club.org.uk if that helps you debug.

[SavageCore]

I'm now letting BIND handle the signing with

auto-dnssec maintain;
inline-signing yes;

Using keys generated from webmin with no issues so I guess close this or if you have some steps for me to try I will.

[jcameron]

I tried to test this, but wasn't able to reach any nameservers for that domain.

[chris001]

The nameservers are
ns2.sheenrose.co.uk
ns3.sheenrose.co.uk
They respond to queries for NS, A, SOA, MX , maybe more...
They seem to not want to reply to queries for ALL records though.

[Adambean]

Hi @SavageCore,

I'm having the same issue now on domain name "reece.wales". Which file did you put those two configuration options in?

[SavageCore]

@Adambean issue from 2016?! searching brain archives...

They go into /etc/named.conf or wherever your zone is defined. They're in a block as such:

 zone "savagecore.eu" {
  type master;
  file "/var/named/savagecore.eu.hosts";
  allow-query { any; };
  auto-dnssec maintain;
  inline-signing yes;
 };

[Adambean]

Hi @SavageCore, haha yep :D Not found those lines anywhere in any of the named files so I guess the issue is still relevant.

I'm running on Debian 9, so my zone entries are in /etc/bind/named.conf.local instead. Added those entries and the warnings have done from Verisign's tool, thanks. 👍 (I use BuddyNS too though so I'll need to wait for them to poll the latest zone serial in for the issue to resolve completely.)