How to Set Up DNSSEC on Linux DNS Server

DNSSEC adds cryptographic signatures to DNS records, allowing resolvers to verify that responses are authentic and untampered.

Step 1 — Generate DNSSEC Keys

cd /etc/bind/zones
dnssec-keygen -a NSEC3RSASHA1 -b 1024 -n ZONE yourdomain.com
dnssec-keygen -a NSEC3RSASHA1 -b 2048 -f KSK -n ZONE yourdomain.com

Step 2 — Add Keys to Zone File

$INCLUDE /etc/bind/zones/Kyourdomain.com.+007+XXXXX.key
$INCLUDE /etc/bind/zones/Kyourdomain.com.+007+YYYYY.key

Step 3 — Sign the Zone

dnssec-signzone -A -3 $(head -c 1000 /dev/random | sha1sum | cut -b 1-16)   -N INCREMENT -o yourdomain.com -t   /etc/bind/zones/yourdomain.com.db

Step 4 — Update BIND Configuration

zone "yourdomain.com" {
    type master;
    file "/etc/bind/zones/yourdomain.com.db.signed";
    auto-dnssec maintain;
    inline-signing yes;
};

Step 5 — Add DS Record to Registrar

dnssec-dsfromkey /etc/bind/zones/Kyourdomain.com.+007+YYYYY.key

Step 6 — Verify

dig yourdomain.com +dnssec
# Look for: ad flag (authentic data)

Conclusion

DNSSEC protects against DNS hijacking. Our team implements DNSSEC and DNS security hardening for production domains.