dnssec 命令

config 1:

    dnssec-keygen -f KSK -a RSASHA1 -b 512 -n ZONE edu.com.
dnssec-keygen -a RSASHA1 -b 512 -n ZONE edu.com.
dnssec-signzone -o  edu.com. db.edu.com
systemctl restart named

dnssec-signzone -o  com. db.com
systemctl restart named

localdns:
systemctl restart named

config 2:

    dnssec-keygen -f KSK -a RSASHA1 -b 512 -P 20160727093000 -A 20160727093000 -R 20170727094500 -I 20170727100000 -D 20170727100000 -n ZONE edu.com.

dnssec-keygen -a RSASHA1 -b 512 -P 20160727093000 -A 20160727093000 -R 20160727094500 -I 20160727100000 -D 20160727100000 -n ZONE edu.com.

dnssec-signzone  -s 20160827093000 -e 20160827094500 -X 20160827095000 -o  edu.com. db.edu.com

dnssec-keygen -f KSK -a RSASHA1 -b 512 -P 20160801013000 -A 20160801013000 -R 20160827094500 -I 20160827100000 -D 20160827100000 -n ZONE edu.com.
dnssec-keygen -a RSASHA1 -b 512 -P 20160827013000 -A 20160827013000 -R 20160827094500 -I 20160827100000 -D 20160827100000 -n ZONE edu.com.

dnssec-keygen
-P: 公布一个key
-A: key处于激活状态
-R: 撤销一个key
-I: key处于非激活状态
-D：删除key

dnssec-signzone
-S：自动回滚标志（自动回滚配合密钥时间参数）
-s：密钥签名生效时间
-e：密钥签名失效时间
-X：密钥签名超时时间