Migrating automatically signed zones from Bind to Knot DNS is very easy due to the fact that Knot DNS is able to use DNSSEC keys generated by Bind.
To obtain current content of the zone which is being migrated, request Bind to flush the zone into the zone file: rndc flush example.com.
Note: If dynamic updates (DDNS) are enabled for the given zone, you might need to freeze the zone before flushing it. That can be done similarly: rndc freeze example.com
Copy the fresh zone file into the zones storage directory of Knot DNS. It’s default location is /var/lib/knot.
We recommend to store DNSSEC keys for each zone in a separate directory. For this purpose, create a directory example.com.keys in zones storage directory. Then copy all DNSSEC keys (*.key and *.private) from Bind key directory (configured as key-directory) into the newly created one.
Add the zone into the Knot DNS configuration file. Zone configuration should contain at least specification of the zone file (option file), key directory (option dnssec-keydir), and enable automatic DNSSEC signing (option dnssec-enable).
You can follow this example:
zones {
storage "/var/lib/knot";
example.com {
dnssec-enable on;
dnssec-keydir "example.com.keys";
file "example.com.db";
}
}
Start Knot DNS and check the log files to make sure that everything went right.