Migration from other DNS servers

Knot DNS for BIND users

Automatic DNSSEC signing

Migrating automatically signed zones from BIND to Knot DNS is very easy due to the fact that Knot DNS is able to use DNSSEC keys generated by BIND.

  1. To obtain current content of the zone which is being migrated, request BIND to flush the zone into the zone file: rndc flush example.com.

    Note: If dynamic updates (DDNS) are enabled for the given zone, you might need to freeze the zone before flushing it. That can be done similarly: rndc freeze example.com

  2. Copy the fresh zone file into the zones storage directory of Knot DNS. Its default location is /var/lib/knot.

  3. We recommend to store DNSSEC keys for each zone in a separate directory. For this purpose, create a directory example.com.keys in the zones storage directory. Then copy all DNSSEC keys (*.key and *.private) from BIND key directory (configured as key-directory) into the newly created one.

  4. Add the zone into the Knot DNS configuration file. Zone configuration should contain at least the specification of the zone file (option file), key directory (option kasp-db), and permission for automatic DNSSEC signing (option dnssec-signing).

    You can follow this example:

    zone:
      - domain: "example.com."
        file: "example.com.db"
        storage: "/var/lib/knot"
        dnssec-signing: on
        kasp-db: "example.com.keys"
    
  5. Start Knot DNS and check the log files to make sure that everything went right.

Table Of Contents

Previous topic

knsupdate – Dynamic DNS update utility

This Page