Bug #10330


BIND zone configuration displays wrong DS resource record with inline DNSSEC signing enabled

Added by Andreas Grommek about 3 years ago. Updated 11 months ago.

Target version:
Start date:
Due date:
% Done:


Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
Affected Architecture:


Hi everybody

The zone GUI for the BIND DNS server helpfully displays the DS resource records to transfer to the parent zone when inline DNSSEC signing is enabled. However, if one enables inline DNSSEC signing for both a zone and a child zone on the same server instance, the wrong DS resource records are displayed in the parent zone configuration GUI.

Steps to reproduce:

  1. Create a zone using the GUI, e.g., enable DNS inline-signing, save. --> DS records for are displayed correctly in the GUI for zone
  2. Create a subzone using the GUI, e.g., enable DNS inline-signing, save. --> DS RRs for are displayed correctly in the GUI for zone
  3. Edit parent zone ( again, of just open and click "save" without any changes. --> Now the DS RRs for subzone are wrongly displayed in the GUI for parent zone

I verified that this is a display problem "only". Asking the server for DNSKEY RRs for the zones and returns the correct DNSKEY RRs for these zones. The public keys returned from a DNS query were compared to the keys living in /cf/named/etc/namedb/keys on pfSense and they match.

Maybe interesting/important background: My parent zone ( only contains delegation entries to the subzones, i.e. NS RRs delegating to the authoritative name servers for the subzones which happen to have the same A and AAAA RRs as the server for the parent zone, as indicated by the glue records. I chose this setup to be able to easily move subzones to a different/dedicated authoritative server at a later date.

Here is how the zone file for my parent zone looks like:

$TTL 300
        013 ; serial
        1h ; refresh
        2h ; retry
        10w ; expire
        1h ; default_ttl

@         IN NS
ns        IN A
ns        IN AAAA   fd00:192:168:77::f:1

sub1      IN NS
ns.sub1   IN A
ns.sub1   IN AAAA   fd00:192:168:77::f:1

sub2      IN NS
ns.sub2   IN A
ns.sub2   IN AAAA   fd00:192:168:77::f:1

sub3      IN NS
ns.sub3   IN A
ns.sub3   IN AAAA   fd00:192:168:77::f:1
Actions #1

Updated by Viktor Gurov over 2 years ago

  • Affected Version deleted (2.2.4)
Actions #2

Updated by Jim Pingle over 2 years ago

  • Status changed from New to Pull Request Review
Actions #3

Updated by Renato Botelho over 2 years ago

  • Status changed from Pull Request Review to Feedback
  • Assignee set to Renato Botelho
  • % Done changed from 0 to 100

PR has been merged. Thanks!

Actions #4

Updated by Renato Botelho 11 months ago

  • Assignee deleted (Renato Botelho)

Also available in: Atom PDF