I'm migrating the primary BIND DNS configuration from an existing CentOS 7 server to a new Oracle Linux 9 server. I copied the named configuration and zone data, including /etc/named.conf and /var/named, and the new server will use the old server's IP address after the old one is shut down. When I start named on Oracle Linux 9, it reports "validating arpa/DS: no valid signature found" and "validating com/DS: no valid signature found." The service does start, but I'm unsure whether these are harmless warnings or signs of a configuration problem. The default configuration includes dnssec-validation yes;, although that line was removed from my migrated configuration. I'm relatively new to DNS administration and would like to know the likely cause, whether downgrading BIND is advisable, and the safest way to migrate the configuration.
2 Answers
Those messages usually come from DNSSEC validation being enabled in the newer BIND configuration. First determine whether named is failing or merely logging warnings. Check the service status and logs, then run named-checkconf and named-checkzone against the configuration and each zone. If this server is acting as a recursive resolver, DNSSEC validation may be appropriate, but it must be configured consistently and the server needs working access to the DNS root trust chain. If it only serves authoritative zones, recursive DNSSEC validation may not be needed and should generally be disabled by starting from the Oracle Linux default configuration and explicitly setting the desired recursion and validation behavior.
Avoid downgrading BIND just to preserve an old configuration. Fixing the configuration for the supported version is safer and gives you current security updates. Since this is an authoritative server for a domain, the cleanest migration is to run the new server alongside the old one temporarily, transfer or copy the zones, verify answers from both servers, and then change the delegation or switch the address during a planned cutover. Make sure the new server is not running simultaneously with the old one on the same IP address.
The old server has already been shut down during testing, so there is no simultaneous IP conflict. I’ll validate the new configuration and zone files before the final switch.
The service does start, but the validation messages appear during startup. I removed dnssec-validation yes; from the copied configuration and was wondering whether downgrading BIND would avoid changing the existing setup.