Description of problem: The current package of bind97 contains file "named.iscdlv.key" which is out-dated, and doesn't reflect the keys of the root zone. This file should be replaced with this one: http://ftp.isc.org/isc/bind9/keys/9.7/bind.keys.v9_7 Version-Release number of selected component (if applicable): bind97-9.7.0-6.P2.el5 How reproducible: Always Steps to Reproduce: 1. Use current bind97 package in DNSSEC configuration 2. Note complaints in the BIND logs about the root zone being unsigned Actual results: Lots of log entries with this format: dnssec: validating @0x9a3f280: . NSEC: no valid signature found dnssec: validating @0x9a3f280: . SOA: no valid signature found Expected results: BIND package should be able to correct validate the root zone. Additional info: http://www.isc.org/community/blog/201007/using-root-dnssec-key-bind-9-resolvers
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-0043.html