Understand DNSSEC when managing BIND 9 DNS from Blesta
PD BIND 9 DNS edits supported DNS records but does not provide a module control to turn BIND zone signing on or off. Manage signing and its lifecycle through the responsible DNS administrator.
Separate record editing from signing
A valid ordinary record change is not proof that updated signed answers are available publicly. BIND’s signing policy, key material and parent trust chain remain server-side responsibilities. Keep them separate from the module’s SSH connection and client binding.
ISC’s BIND DNSSEC guide describes signing and the relationship between child zones and their parents. Use the administrator’s supported arrangement for this server rather than copying a signing recipe into the billing panel.
Check a changed signed zone
- Identify the intended provider, editable zone and authoritative nameservers.
- Confirm the ordinary record write and its activation result.
- Ask the administrator to verify the server’s current signing state.
- Compare the parent DS with the intended signing material.
- Verify a public validating DNS response separately from the connection test.
The missing enable/disable button is expected in this module. Do not broaden SSH access merely to look for a signing control that is not supplied.
Keep recovery and trust separate
A BIND-format record snapshot does not preserve secret signing keys or reconstruct parent DS publication. A migration, recovery or disabling plan must account for those dependencies before changing DNS that is already signed.
If DNS data appears correct but validating resolvers fail, retain the redacted record/activation result and ask the DNS administrator to investigate the signing chain. Do not remove keys or parent trust records as an experiment. Use the maintenance guide for the separate provider and job checks.
See the PD BIND 9 DNS Blesta guide for related tasks, or explore the module.
