Bind

dnssec-signzone:錯誤:dns_master_load:domain.tld.zone:3:domain.tld:不在區域頂部

  • March 25, 2021

我正在嘗試簽署 NSD 區域,但出現以下錯誤,我不明白為什麼:

$ dnssec-keygen -a ed25519 -3 -K /etc/dnssec/mykeys/ example.com
Generating key pair.
Kexample.com.+015+06293
$ dnssec-signzone -S -K /etc/dnssec/mykeys/  /var/lib/nsd/example.com.zone
dnssec-signzone: error: dns_master_load: example.com.zone:3: example.com: not at top of zone
dnssec-signzone: fatal: failed loading zone from '/var/lib/nsd/example.com.zone': not at top of zone

我有以下區域:

$ORIGIN example.com.
$TTL 1800
@    IN   SOA    ns.example.com.    admin.example.com. (
                                      20210324
                                      3600
                                      900
                                      1209600
                                      1800
                                       )
srv   IN   A     94.23.xx.xx
srv   IN   AAAA  2001:xx:xx::
ns    IN   CNAME srv.example.com.
@     IN   NS    ns.example.com.

我相信您只是想使用該-o zonename選項,因為文件名與區域名稱不同(-o不使用時的預設假設)。

該錯誤似乎與SOA記錄不在該區域的頂點有關,這似乎是有道理的example.comexample.com.zone

引用自:https://serverfault.com/questions/1058221