Migrating automatically signed zones from BIND to Knot DNS requires copying up-to-date zone files from BIND, importing existing private keys, and updating server configuration:
To obtain current content of the zone which is being migrated, request BIND to flush the zone into the zone file: rndc flush example.com.
Note
If dynamic updates (DDNS) are enabled for the given zone, you might need to freeze the zone before flushing it. That can be done similarly:
$ rndc freeze example.com
Copy the fresh zone file into the zones storage directory of Knot DNS. Its default location is /var/lib/knot.
Initialize DNSSEC KASP database (default location is /var/lib/knot/keys and create a dedicated signing policy for the imported zones with manual key management:
$ cd /var/lib/knot/keys
$ keymgr init
$ keymgr policy add bind manual true
Note
The server can be run under a dedicated user account, usually knot. As the server requires read-write access to the KASP database, the permissions must be set correctly. This can be achieved for instance by executing all KASP database management commands under sudo:
$ sudo -u knot keymgr ...
For each imported zone, create an entry in the KASP database and import all existing keys. Make sure that all keys were configured correctly:
$ keymgr zone add example.com policy bind
$ keymgr zone key import example.com path/to/Kexample.com.+013+11111
$ keymgr zone key import example.com path/to/Kexample.com.+013+22222
$ ...
$ keymgr zone key list example.com
Add the zone into the Knot DNS configuration. Zone configuration must include correct zone file path (option file) and KASP database location (option kasp-db). You can follow this configuration file snippet:
zone:
- domain: example.com
storage: /var/lib/knot
kasp-db: /var/lib/knot/keys
file: example.com.zone
dnssec-signing: on
Start Knot DNS and check the log files to verify that everything went right.
Optionally, review the used KASP policy and enable automatic key management:
$ keymgr policy set bind manual false
$ sudo knotc reload