Jump to first page
 -115
Zone signing keys
Signing a Zone 2
Signing the Zone
Key signing keys
ninclude the keys for the apex into your zone:
ucat Ksecret-wg.org.+001+20704.key >> secret-wg.org
ucat Ksecret-wg.org.+001+16748.key >> secret-wg.org
ucat Ksecret-wg.org.+001+86491.key >> secret-wg.org
nIncrease the SOA serial number
uAlways increase the SOA serial before signing!
nSign the zone:
udnssec-signzone -k   Ksecret-wg.org.+001+20704 \
u       secret-wg.org Ksecret-wg.org.+001+16748 \
u                     Ksecret-wg.org.+001+86491
n
Note:

Your zone file should have a default TTL at the top.
$TTL 1D

All records in your zone file that do not have their TTL explicitly set will get the default TTL when loaded by the name server from the zone file.

If you store your zones in files that do not have the same name as the zone itself you will need to use the Ô-o <origin>Õ flag when signing. For instance if the ripe.net zonefile is named ripe.db the command would look like this:

dnssec-signzone  -o ripe.net  ripe.db  Kripe.net.+001.+20704

If you forget to increase the serial number before signing; your slave will not pick up your resigned zone and zones may get ÔbadÕ because of signature expiration of the data published by slaves.
Alternatively one can use $include Ksecret-wg.org.+001+20704.key to include the key into the zone file.