On Wed, 2004-11-10 at 17:16 +0100, Francis Dupont wrote: > About DDNS and DNSSEC: they don't work well together because DDNS > requires private (zone) keys are online to update signatures when > DNSSEC works well and safer with offline keys. > > Regards > > Francis.Dupont@enst-bretagne.fr > > PS: I locally solved this operational issue with a dedicated DDNS sub-zone. I guess this is the solution used in most cases. Many people like the format of their zones and ddns updates destroy the formatting of the zones file (at least bind does this). Thus you make CNAMES from the main zone to the subzone without bothering the clean zone. Isn't this part of an RFC or BCP actually? Greets, Jeroen
Attachment:
signature.asc
Description: This is a digitally signed message part