<div dir="ltr"><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Sep 11, 2014 at 9:50 AM, Jeroen van der Ham <span dir="ltr"><<a href="mailto:vdham@uva.nl" target="_blank">vdham@uva.nl</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<span class=""><br>
On 22 Aug 2014, at 16:57, Rene Bartsch <<a href="mailto:ml@bartschnet.de">ml@bartschnet.de</a>> wrote:<br>
> BIND and PowerDNS can sign resource records automatically when run as primary DNS with DNSSEC. Does Dnsmasq support signing resource records automatically in authoritative mode or are there any plans to support automatic zone signing in authoritative mode?<br>
<br>
</span>When exactly would you want dnsmasq to run as an authoritative name server?<br></blockquote><div><br></div><div class="gmail_default" style="font-size:small">All the time, for my home network. It's my name space, I control it, and I need to have control over what names are globally/locally visible.</div><div class="gmail_default" style="font-size:small"></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Note that signing records is not as simple as just flipping a switch, the key has to be trusted as well. Which means that you have to register a key at your registrar.</blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
If it is for private use, there is no reason to use DNSSEC anyway.<br></blockquote><div><br></div><div class="gmail_default" style="font-size:small">Sure there is; other wise any connection to devices on your home network are vulnerable to MITM attacks. I can't/should not have to trust either my ISP or registrar with my signing keys. As we've seen over the lsat year, there are "interesting" people out on the Internet doing bad things these days.</div><div class="gmail_default" style="font-size:small"> - Jim</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<span class="HOEnZb"><font color="#888888"><br>
Jeroen.<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
<br>
_______________________________________________<br>
Dnsmasq-discuss mailing list<br>
<a href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk">Dnsmasq-discuss@lists.thekelleys.org.uk</a><br>
<a href="http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss" target="_blank">http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss</a><br>
</div></div></blockquote></div><br></div></div>