Migration from other DNS servers¶
Knot DNS for BIND users¶
Automatic DNSSEC signing¶
Migrating automatically signed zones from BIND to Knot DNS is very easy due to the fact that Knot DNS is able to use DNSSEC keys generated by BIND.
To obtain current content of the zone which is being migrated, request BIND to flush the zone into the zone file:
rndc flush example.com
.Note: If dynamic updates (DDNS) are enabled for the given zone, you might need to freeze the zone before flushing it. That can be done similarly:
rndc freeze example.com
Copy the fresh zone file into the zones storage directory of Knot DNS. Its default location is
/var/lib/knot
.We recommend to store DNSSEC keys for each zone in a separate directory. For this purpose, create a directory
example.com.keys
in the zones storage directory. Then copy all DNSSEC keys (*.key
and*.private
) from BIND key directory (configured askey-directory
) into the newly created one.Add the zone into the Knot DNS configuration file. Zone configuration should contain at least the specification of the zone file (option
file
), key directory (optionkasp-db
), and permission for automatic DNSSEC signing (optiondnssec-signing
).You can follow this example:
zone: - domain: "example.com." file: "example.com.db" storage: "/var/lib/knot" dnssec-signing: on kasp-db: "example.com.keys"
Start Knot DNS and check the log files to make sure that everything went right.