Forum Discussion

Techgeeeg_28888's avatar
Techgeeeg_28888
Icon for Nimbostratus rankNimbostratus
Jun 20, 2015

DNSSEC Config

Hi Everyone,

 

I would like to have the input from the experts here.... regarding DNS and DNSSEC... if I am using F5 GTM as an authoritative DNS for my Domain what are the things I have to get done on the ISP side or Domain registrar side. Also if I configure DNSSEC on GTM do I need to get anything configured on the ISP end?? Pls provide your input with practical experiences.

 

Regards,

 

BIG-IP DNS
deployment
design

4 Replies

Sort By
  • gsharri's avatar
    gsharri
    Icon for Altostratus rankAltostratus
    Jun 21, 2015

    After generating the keys and creating the DNSSEC zone on GTM you will need to submit the DS (delegation signer) record to your parent dns domain. See Sol12981

     

    As long as the parent domains are signed also you should be good to go.

     

  • Techgeeeg's avatar
    Techgeeeg
    Icon for Nimbostratus rankNimbostratus
    Jun 21, 2015

    Thanks Scott can you elaborate more on submitting the DS record to the parent DNS domain?? I have my domain e.g "company.com" registered with a Domain registrar and there I have the NS IP's defined which are the SELF IP's of GTM and Listener are created on the same IP as well. Now this DS will be submitted to my domain registrar? That's what you are saying???

     

  • gsharri's avatar
    gsharri
    Icon for Altostratus rankAltostratus
    Jun 23, 2015

    Your domain registrar must support DNSSEC and the parent domain, .com in your example, must support DNSSEC. The DS record for company.com must be found in .com so clients can verify your signed resource records.

     

    See these links for examples of the process and requirements: Domain Registrars and DS Record step-by-step