How does DNSSEC work in GTM?

Short answer

In GTM, DNSSEC is turned on per domain with the DNSSEC switch in the domain form (default Disabled). When it is turned on, the DNS Service to which the domain is bound generates a key for the zone and signs the answers at query time; the addresses that change according to health checks and scenarios, and the DR and Fail-safe answers, also go out signed, and no manual re-signing is needed when a record or the health status changes. The DS values to be submitted to the parent zone are seen in the DNSSEC Info for window opened from the DNSSEC lock in the Domains list; in a cluster, since each device signs the zone with its own key, the DS values of each device are shown in a separate table.

How Does It Work?

The general working of DNSSEC: What is DNSSEC? In GTM, the flow is as follows:

1. Turning on: When DNSSEC is set to Enabled and the form is saved, the DNS Service on the device deletes the previous keys of the zone, generates a new active key and starts serving the zone signed.
2. Answer: Each answer is signed together with the addresses selected at that moment. GTM's answers that change according to health also pass DNSSEC validation.
3. DS: The values of the DS Records table in the DNSSEC Info for window (Key Tag, Algorithm, Digest Type, Digest) are submitted to the parent zone, in practice to the registrar; the DNS KEY row under the table shows the public key of the zone (What is a DS record; why is it submitted to the registrar in DNSSEC?).
4. Turning off: When DNSSEC is set to Disabled, the keys are deleted and the zone is served unsigned. Since a new key is generated when it is turned on again, the DS values also change.

DNSSEC in TR7

Where	What is seen / done
Domains → Add / Edit → DNSSEC	Turning on / off per domain
Domains list, DNSSEC column	A lock icon on domains with DNSSEC on; when it is clicked, the DNSSEC Info for window opens. The list is filtered with the DNSSEC card
Domain preview, DNSSEC row	✔ if on, - if off (Preview of the Selected Domain Name)
DNSSEC Info for window	In a cluster, a separate DS Records table with the device name and a DNS KEY row for each device

• Key management: There is no separate screen or schedule for key rollover; the key changes only when DNSSEC is turned off and on. In this case, the new DS values are entered at the registrar in place of the old ones.
• Cluster: The DNSSEC setting is transferred to the peer device, but each device generates its own key; the DS values of both devices are submitted to the parent zone (How does GTM behave in a cluster?).
• DNS Forwarder: The DNSSEC records in the answers to queries forwarded through DNS Forwarder are passed to the client but are not validated; the DNSSEC setting covers only the domains for which GTM is authoritative.

Common Misconceptions

• "GTM's dynamic answers cannot be used together with DNSSEC." Since the answers are signed at query time, the answers that change according to health are signed too.
• "The zone must be re-signed every time a record changes." It is not necessary; the signature is produced with the current records in every answer.
• "DNSSEC keys are renewed automatically at certain intervals." They are not renewed; turning DNSSEC off and on means a new key and a new DS. Turning it off and on without updating the DS makes the zone fail validation on validating resolvers.

How it is done in the documentation

• Domains · DNSSEC
• Domains · Domains Listing Screen
• Domains · Operating Mechanism

Related questions

• What is DNSSEC?
• What is a DS record; why is it submitted to the registrar in DNSSEC?
• What are DNSKEY, RRSIG and NSEC records?
• What is a domain in GTM; how does it relate to a DNS Service?