MENU
セキュリティエンジニアの学習記録
  1. ホーム
  2. セキュリティ
  3. DNSSEC検証 DNSSEC構築編

DNSSEC検証 DNSSEC構築編

セキュリティ 検証
目次

はじめに

何をしたいか

DNSSECの信頼の連鎖を実際に構築し、DNS応答がどのように署名・検証されるのかを確認する。また、DNSSECに関する設定や署名を意図的に破壊し、検証失敗時にフルリゾルバやクライアントからどのように見えるのかを確認する。
前回の「準備・DNS構築編」では、DNSSECを使用しない通常のDNS環境を構築した。
本記事では、この環境にDNSSECを導入し、信頼の連鎖を構築する。

準備・DNS構築編　https://cybermemo.blog/dnssec-lab-setup
DNSSEC構築編　本記事
DNSSEC破壊・検証編　https://cybermemo.blog/dnssec-lab-testing

本記事で構築する構成

前回構築したDNS環境にDNSSECを導入する。

              ┌─────────────┐
              │ Parent DNS  │　192.168.56.10/24
              │    BIND9    │　権威ゾーン: lab.test
              │             │　DNSKEY / RRSIG
              └──────┬──────┘
                     │
            child.lab.test を委任
              ＋ DSレコード
                     │
                     ▼
              ┌─────────────┐　192.168.56.20/24
              │  Child DNS  │　権威ゾーン: child.lab.test
              │    BIND9    │　DNSKEY / RRSIG
              │             │　└─ www.child.lab.test → 192.168.56.100
              └─────────────┘
                     ▲
                     │ DNS問い合わせ
                     │ ＋ DNSSEC署名情報
                     │
              ┌─────────────┐
              │  Resolver   │ 192.168.56.30/24
              │   Unbound   │ DNSSEC検証
              │             │ Trust Anchor: lab.test
              └──────┬──────┘
                     ▲
                     │ DNS問い合わせ
                     │
              ┌─────────────┐
              │   Client    │ 192.168.56.40/24
              └─────────────┘
【DNSSECの信頼の連鎖】

Trust Anchor
（lab.test KSK / DNSKEY）
        │
        ▼
lab.test DNSKEY RRset
        │
        │ ParentのDSによってChild KSKを信頼
        ▼
child.lab.test DNSKEY RRset
        │
        │ Child ZSKの公開鍵でRRSIGを検証
        ▼
www.child.lab.test A

検証環境

仮想化ソフトウェア：Oracle VirtualBox
ゲストOS：Ubuntu Server 26.04.1 LTS（amd64）
権威DNS：BIND 9.20.24
フルリゾルバ：Unbound 1.24.2
DNS確認ツール：DiG 9.20.24
内部ネットワーク：192.168.56.0/24
検証ドメイン：lab.test / child.lab.test

構築

ChildゾーンをDNSSEC署名

Child DNS で作業。

鍵生成

# ゾーンファイルを確認
$ sudo cat /etc/bind/db.child.lab.test
$TTL 3600

@   IN SOA ns dnsmaster (
        2026090401 ; Serial
        3600       ; Refresh
        900        ; Retry
        604800     ; Expire
        86400      ; Negative Cache TTL
)

    IN NS ns

ns  IN A 192.168.56.20
www IN A 192.168.56.100

# DNSSEC鍵を置くディレクトリを作る
$ sudo mkdir -p /etc/bind/keys/child.lab.test

# ZSKを生成
$ cd /etc/bind/keys/child.lab.test
$ sudo dnssec-keygen -a ECDSAP256SHA256 -n ZONE child.lab.test
Generating key pair.
Kchild.lab.test.+013+07661

# KSKを生成
$ sudo dnssec-keygen -a ECDSAP256SHA256 -f KSK -n ZONE child.lab.test
Generating key pair.
Kchild.lab.test.+013+26145

# 生成ファイルを確認
$ sudo ls -l /etc/bind/keys/child.lab.test
total 16
-rw-r--r-- 1 root bind 347 Sep  9 12:59 Kchild.lab.test.+013+07661.key
-rw------- 1 root bind 187 Sep  9 12:59 Kchild.lab.test.+013+07661.private
-rw-r--r-- 1 root bind 347 Sep  9 13:00 Kchild.lab.test.+013+26145.key
-rw------- 1 root bind 187 Sep  9 13:00 Kchild.lab.test.+013+26145.private

# 公開鍵の中身を確認　
$ sudo cat Kchild.lab.test.+013+07661.key && sudo cat Kchild.lab.test.+013+26145.key
; This is a zone-signing key, keyid 7661, for child.lab.test.
; Created: 20260909125923 (Wed Sep  9 12:59:23 2026)
; Publish: 20260909125923 (Wed Sep  9 12:59:23 2026)
; Activate: 20260909125923 (Wed Sep  9 12:59:23 2026)
child.lab.test. IN DNSKEY 256 3 13 of3bj/PGoJ9JAF2HN02sQ4xKhSjPBt8c0iLmok/IcnloBP0A+Wm+vqj6 ZM7v1/HXQmi6odv+eJ/+O4lfOMEkiQ==
; This is a key-signing key, keyid 26145, for child.lab.test.
; Created: 20260909130016 (Wed Sep  9 13:00:16 2026)
; Publish: 20260909130016 (Wed Sep  9 13:00:16 2026)
; Activate: 20260909130016 (Wed Sep  9 13:00:16 2026)
child.lab.test. IN DNSKEY 257 3 13 RfvhGg1akSrUMv7Ub87SsXXHUJt0NRWW7hUtG8rS0x6gLM9b8+vpx0A1 qNvm10S/hEEPaa9SAz/7Hrq87Rcyiw==

Childのゾーンファイルを署名

# ディレクトリ移動
$ cd /etc/bind

# バックアップ取得
$ sudo cp db.child.lab.test db.child.lab.test.bak

# 2つの.keyをゾーンファイルへ追加
$ sudo sh -c 'cat keys/child.lab.test/*.key >> db.child.lab.test'　　

# Serialを変更
$ sudo vim /etc/bind/db.child.lab.test　　
$TTL 3600

@   IN SOA ns dnsmaster (
        2026090901 ; Serial
        3600       ; Refresh
        900        ; Retry
        604800     ; Expire
        86400      ; Negative Cache TTL
)

    IN NS ns

ns  IN A 192.168.56.20
www IN A 192.168.56.100
; This is a zone-signing key, keyid 7661, for child.lab.test.
; Created: 20260909125923 (Wed Sep  9 12:59:23 2026)
; Publish: 20260909125923 (Wed Sep  9 12:59:23 2026)
; Activate: 20260909125923 (Wed Sep  9 12:59:23 2026)
child.lab.test. IN DNSKEY 256 3 13 of3bj/PGoJ9JAF2HN02sQ4xKhSjPBt8c0iLmok/IcnloBP0A+Wm+vqj6 ZM7v1/HXQmi6odv+eJ/+O4lfOMEkiQ==
; This is a key-signing key, keyid 26145, for child.lab.test.
; Created: 20260909130016 (Wed Sep  9 13:00:16 2026)
; Publish: 20260909130016 (Wed Sep  9 13:00:16 2026)
; Activate: 20260909130016 (Wed Sep  9 13:00:16 2026)
child.lab.test. IN DNSKEY 257 3 13 RfvhGg1akSrUMv7Ub87SsXXHUJt0NRWW7hUtG8rS0x6gLM9b8+vpx0A1 qNvm10S/hEEPaa9SAz/7Hrq87Rcyiw==

# 構文チェック
$ sudo named-checkzone child.lab.test /etc/bind/db.child.lab.test
zone child.lab.test/IN: loaded serial 2026090901
OK

# ディレクトリ移動
$ cd /etc/bind/keys/child.lab.test

# dnssec-signzoneで署名
$ sudo dnssec-signzone \　　
  -S \
  -o child.lab.test \
  -f /etc/bind/db.child.lab.test.signed \
  /etc/bind/db.child.lab.test
Verifying the zone using the following algorithms:
- ECDSAP256SHA256
Zone fully signed:
Algorithm: ECDSAP256SHA256: KSKs: 1 active, 0 stand-by, 0 revoked
                            ZSKs: 1 active, 0 stand-by, 0 revoked
/etc/bind/db.child.lab.test.signed

# 署名済みゾーンファイルが生成されたことを確認
$ sudo ls -l /etc/bind/db.child.lab.test*　　
-rw-r--r-- 1 root bind  947 Sep  9 13:22 /etc/bind/db.child.lab.test
-rw-r--r-- 1 root bind  253 Sep  9 13:18 /etc/bind/db.child.lab.test.bak
-rw-r--r-- 1 root bind 2726 Sep  9 13:25 /etc/bind/db.child.lab.test.signed

# 署名済みゾーンを確認
$ sudo cat /etc/bind/db.child.lab.test.signed
; File written on Wed Sep  9 13:25:36 2026
; dnssec-signzone version 9.20.24-1ubuntu0.3-Ubuntu
child.lab.test.         3600    IN SOA  ns.child.lab.test. dnsmaster.child.lab.test. (
                                        2026090901 ; serial
                                        3600       ; refresh (1 hour)
                                        900        ; retry (15 minutes)
                                        604800     ; expire (1 week)
                                        86400      ; minimum (1 day)
                                        )
                        3600    RRSIG   SOA 13 3 3600 (
                                        20261009122536 20260909122536 7661 child.lab.test.
                                        lPLC99bWrcmgzGCGwL20o7A8yPGr/w7wMtIo
                                        9XVRflFmyorQ01L1PHOj1n/s6ZG3DwtYsgjE
                                        1Uklg/WEIQdbPA== )
                        3600    NS      ns.child.lab.test.
                        3600    RRSIG   NS 13 3 3600 (
                                        20261009122536 20260909122536 7661 child.lab.test.
                                        U2708D42QzU3kgqX0gcaoOLQD9H7pNVG8/IH
                                        VnrNK5InPpyeNCRyq5sSa1oxdXuVITovo+eB
                                        QSkKU/OAlGeM+Q== )
                        3600    NSEC    ns.child.lab.test. NS SOA RRSIG NSEC DNSKEY
                        3600    RRSIG   NSEC 13 3 3600 (
                                        20261009122536 20260909122536 7661 child.lab.test.
                                        Gt28Z9fQT56l0ONZa1YpEL7+22gH7RgxT178
                                        n5Zf3/4TH7UPSSx0lQE5nWpUb52A7+VlF5ix
                                        8K1v9MX31Psl/w== )
                        3600    DNSKEY  256 3 13 (
                                        of3bj/PGoJ9JAF2HN02sQ4xKhSjPBt8c0iLm
                                        ok/IcnloBP0A+Wm+vqj6ZM7v1/HXQmi6odv+
                                        eJ/+O4lfOMEkiQ==
                                        ) ; ZSK; alg = ECDSAP256SHA256 ; key id = 7661
                        3600    DNSKEY  257 3 13 (
                                        RfvhGg1akSrUMv7Ub87SsXXHUJt0NRWW7hUt
                                        G8rS0x6gLM9b8+vpx0A1qNvm10S/hEEPaa9S
                                        Az/7Hrq87Rcyiw==
                                        ) ; KSK; alg = ECDSAP256SHA256 ; key id = 26145
                        3600    RRSIG   DNSKEY 13 3 3600 (
                                        20261009122536 20260909122536 7661 child.lab.test.
                                        FgbLJ9v+yNnKLs6sMEWIk8smobeazyZoFiPm
                                        XA0HU4EAHnthv8olg7KmNGjgm/tcuPvUQgMs
                                        f7lK3BgevwukFQ== )
                        3600    RRSIG   DNSKEY 13 3 3600 (
                                        20261009122536 20260909122536 26145 child.lab.test.
                                        NYOgC1JsircR22X5nwPl1S+XfF4hhRlWBiEA
                                        MYhf0gKxJcupAUy1rMSj25VMcbvx0jurFW76
                                        VVjxFmMXOrfGIg== )
ns.child.lab.test.      3600    IN A    192.168.56.20
                        3600    RRSIG   A 13 4 3600 (
                                        20261009122536 20260909122536 7661 child.lab.test.
                                        f6r7LraRZm76e0HcFZAP1sxMXz+FdGdNHZ1I
                                        R/58BloWPWrIxYtVorV7Yj5jYDHkGqsiB10W
                                        FItH0NhA3S2+FA== )
                        3600    NSEC    www.child.lab.test. A RRSIG NSEC
                        3600    RRSIG   NSEC 13 4 3600 (
                                        20261009122536 20260909122536 7661 child.lab.test.
                                        nI9GreBE6XjqVVTljaicF804VAnZS53p0hpr
                                        TU4h7qMdLL2frKJF5nEtZr1hH803Tw5MT0F8
                                        jE6nCtQBDmfZhA== )
www.child.lab.test.     3600    IN A    192.168.56.100
                        3600    RRSIG   A 13 4 3600 (
                                        20261009122536 20260909122536 7661 child.lab.test.
                                        XX27GC+TFLVYuz+Jd8Ox7SyC5yxL1ifF+cuS
                                        mi+J8jcqgW8NQhR+Fi8sFaHbAEZuw691gEoZ
                                        22rXmWlCL5sbOQ== )
                        3600    NSEC    child.lab.test. A RRSIG NSEC
                        3600    RRSIG   NSEC 13 4 3600 (
                                        20261009122536 20260909122536 7661 child.lab.test.
                                        QHkt5+ujPGQ/3UTapTfDNMUzvzt6C9LdBVJL
                                        xv/isAyQWFphEK/pkbAmTIMDBLKIoBRMyb4i
                                        LUpi1qvRa0CplA== )

BINDが署名済みファイルを使うよう変更

# 署名済みファイルを読み込むよう設定変更
# db.child.lab.test → db.child.lab.test.signed
$ sudo vim /etc/bind/named.conf.local
//
// Do any local configuration here
//

zone "child.lab.test" {
    type primary;
    file "/etc/bind/db.child.lab.test.signed";
};

# 設定をチェックして再読み込み
$ sudo named-checkconf
$ sudo named-checkzone child.lab.test /etc/bind/db.child.lab.test.signed
zone child.lab.test/IN: loaded serial 2026090901 (DNSSEC signed)
OK
$ sudo rndc reconfig
$ sudo rndc zonestatus child.lab.test
$ systemctl status bind9
● named.service - BIND Domain Name Server
     Loaded: loaded (/usr/lib/systemd/system/named.service; enabled; preset: enabled)
     Active: active (running) since Wed 2026-09-09 12:39:27 UTC; 1h 0min ago

DNSKEYを問い合わせる

$ dig +dnssec @192.168.56.20 child.lab.test DNSKEY

; <<>> DiG 9.20.24-1ubuntu0.3-Ubuntu <<>> +dnssec @192.168.56.20 child.lab.test DNSKEY
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43976
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
; COOKIE: 69581b200025ce68010000006aa1633aa773dd222721ebe1 (good)
;; QUESTION SECTION:
;child.lab.test.                        IN      DNSKEY

;; ANSWER SECTION:　　# DNSKEY RRsetに対する署名が応答に含まれている
child.lab.test.         3600    IN      DNSKEY  257 3 13 RfvhGg1akSrUMv7Ub87SsXXHUJt0NRWW7hUtG8rS0x6gLM9b8+vpx0A1 qNvm10S/hEEPaa9SAz/7Hrq87Rcyiw==
child.lab.test.         3600    IN      DNSKEY  256 3 13 of3bj/PGoJ9JAF2HN02sQ4xKhSjPBt8c0iLmok/IcnloBP0A+Wm+vqj6 ZM7v1/HXQmi6odv+eJ/+O4lfOMEkiQ==
child.lab.test.         3600    IN      RRSIG   DNSKEY 13 3 3600 20261009122536 20260909122536 7661 child.lab.test. FgbLJ9v+yNnKLs6sMEWIk8smobeazyZoFiPmXA0HU4EAHnthv8olg7Km NGjgm/tcuPvUQgMsf7lK3BgevwukFQ==
child.lab.test.         3600    IN      RRSIG   DNSKEY 13 3 3600 20261009122536 20260909122536 26145 child.lab.test. NYOgC1JsircR22X5nwPl1S+XfF4hhRlWBiEAMYhf0gKxJcupAUy1rMSj 25VMcbvx0jurFW76VVjxFmMXOrfGIg==

;; Query time: 0 msec
;; SERVER: 192.168.56.20#53(192.168.56.20) (UDP)
;; WHEN: Wed Sep 09 13:46:34 UTC 2026
;; MSG SIZE  rcvd: 451

$ dig +dnssec @192.168.56.20 www.child.lab.test A

; <<>> DiG 9.20.24-1ubuntu0.3-Ubuntu <<>> +dnssec @192.168.56.20 www.child.lab.test A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6047
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
; COOKIE: 2b33bf67976af0a4010000006aa1633f561edffaee841791 (good)
;; QUESTION SECTION:
;www.child.lab.test.            IN      A

;; ANSWER SECTION:　　# RRsetに対する署名が応答に含まれている
www.child.lab.test.     3600    IN      A       192.168.56.100
www.child.lab.test.     3600    IN      RRSIG   A 13 4 3600 20261009122536 20260909122536 7661 child.lab.test. XX27GC+TFLVYuz+Jd8Ox7SyC5yxL1ifF+cuSmi+J8jcqgW8NQhR+Fi8s FaHbAEZuw691gEoZ22rXmWlCL5sbOQ==

;; Query time: 0 msec
;; SERVER: 192.168.56.20#53(192.168.56.20) (UDP)
;; WHEN: Wed Sep 09 13:46:39 UTC 2026
;; MSG SIZE  rcvd: 201

Child DNSのKSKからDSレコードを生成し、Parent DNSに登録

Child DNSのKSKでDSレコードを生成

# 生成した鍵を確認
$ cd /etc/bind/keys/child.lab.test
$ ls -l
total 20
-rw-r--r-- 1 root bind 347 Sep  9 12:59 Kchild.lab.test.+013+07661.key
-rw------- 1 root bind 187 Sep  9 12:59 Kchild.lab.test.+013+07661.private
-rw-r--r-- 1 root bind 347 Sep  9 13:00 Kchild.lab.test.+013+26145.key
-rw------- 1 root bind 187 Sep  9 13:00 Kchild.lab.test.+013+26145.private
-rw-r--r-- 1 root bind 100 Sep  9 13:25 dsset-child.lab.test.

# KSKからDSレコードを生成
$ dnssec-dsfromkey -2 Kchild.lab.test.+013+26145.key
child.lab.test. IN DS 26145 13 2 C0F99483CDF9CE53B7EFBCE8607A73DCAA7B6FA728F24ECFEB01F6532742BF5D

# Parent DNSへDSを登録(Parent DNSで作業)
# Serialを変更、DSレコードを追記
$ sudo vim /etc/bind/db.lab.test
$TTL 3600

@   IN  SOA ns dnsmaster (
        2026091001 ; Serial
        3600       ; Refresh
        900        ; Retry
        604800     ; Expire
        86400      ; Negative Cache TTL
)

    IN  NS  ns.lab.test.

ns  IN  A   192.168.56.10

child       IN NS ns.child
ns.child    IN A  192.168.56.20
child       IN DS 26145 13 2 C0F99483CDF9CE53B7EFBCE8607A73DCAA7B6FA728F24ECFEB01F6532742BF5D

# 設定をチェックして再読み込み
$ sudo named-checkzone lab.test /etc/bind/db.lab.test
$ sudo rndc reload lab.test

# 設定が反映されているか確認
$ dig +norecurse @192.168.56.10 child.lab.test DS

; <<>> DiG 9.20.24-1ubuntu0.3-Ubuntu <<>> +norecurse @192.168.56.10 child.lab.test DS
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51525
;; flags: qr aa ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 575f15af146df5dc010000006aa2a1275fb9a529e926c9cf (good)
;; QUESTION SECTION:
;child.lab.test.                        IN      DS

;; ANSWER SECTION:
child.lab.test.         3600    IN      DS      26145 13 2 C0F99483CDF9CE53B7EFBCE8607A73DCAA7B6FA728F24ECFEB01F653 2742BF5D

;; Query time: 0 msec
;; SERVER: 192.168.56.10#53(192.168.56.10) (UDP)
;; WHEN: Thu Sep 10 12:23:03 UTC 2026
;; MSG SIZE  rcvd: 119

Parent DNSをDNSSEC署名

Parent DNS で作業。

# ディレクトリ作成
$ sudo mkdir -p /etc/bind/keys/lab.test
$ cd /etc/bind/keys/lab.test

# ParentのZSKを生成
$ sudo dnssec-keygen -a ECDSAP256SHA256 -n ZONE lab.test
Generating key pair.
Klab.test.+013+42600

# ParentのKSKを生成
$ sudo dnssec-keygen -a ECDSAP256SHA256 -f KSK -n ZONE lab.test
Generating key pair.
Klab.test.+013+25095

# 生成結果を確認
$ ls -l /etc/bind/keys/lab.test
total 16
-rw-r--r-- 1 root bind 335 Sep 10 12:27 Klab.test.+013+25095.key
-rw------- 1 root bind 187 Sep 10 12:27 Klab.test.+013+25095.private
-rw-r--r-- 1 root bind 336 Sep 10 12:27 Klab.test.+013+42600.key
-rw------- 1 root bind 187 Sep 10 12:27 Klab.test.+013+42600.private

# 公開鍵を確認
$ cat /etc/bind/keys/lab.test/*.key
; This is a key-signing key, keyid 25095, for lab.test.
; Created: 20260910122739 (Thu Sep 10 12:27:39 2026)
; Publish: 20260910122739 (Thu Sep 10 12:27:39 2026)
; Activate: 20260910122739 (Thu Sep 10 12:27:39 2026)
lab.test. IN DNSKEY 257 3 13 nzPV3+LMX633npZfI3Seu2cR8SrTegHIi1sCK2OtNTQyRZg/v6yVkRDl nmr52oumop7xFxsx6vcZk3emfTsFbQ==
; This is a zone-signing key, keyid 42600, for lab.test.
; Created: 20260910122712 (Thu Sep 10 12:27:12 2026)
; Publish: 20260910122712 (Thu Sep 10 12:27:12 2026)
; Activate: 20260910122712 (Thu Sep 10 12:27:12 2026)
lab.test. IN DNSKEY 256 3 13 XGx8XP7w7bqg8k9cBXoPvDLsZQFUOAuUbdr8Bd8ZSH25ip1Bq75BGFYO yZhxy0DNqEsEPPpDt2qHAW/kdlJs3g==

# ParentのDNSKEYをゾーンファイルへ追加
$ sudo sh -c 'cat keys/lab.test/*.key >> db.lab.test'

# Serialを変更
$ sudo vim /etc/bind/db.lab.test　　
$TTL 3600

@   IN  SOA ns dnsmaster (
        2026091002 ; Serial
        3600       ; Refresh
        900        ; Retry
        604800     ; Expire
        86400      ; Negative Cache TTL
)

    IN  NS  ns.lab.test.

ns  IN  A   192.168.56.10

child       IN NS ns.child
ns.child    IN A  192.168.56.20
child       IN DS 26145 13 2 C0F99483CDF9CE53B7EFBCE8607A73DCAA7B6FA728F24ECFEB01F6532742BF5D
; This is a key-signing key, keyid 25095, for lab.test.
; Created: 20260910122739 (Thu Sep 10 12:27:39 2026)
; Publish: 20260910122739 (Thu Sep 10 12:27:39 2026)
; Activate: 20260910122739 (Thu Sep 10 12:27:39 2026)
lab.test. IN DNSKEY 257 3 13 nzPV3+LMX633npZfI3Seu2cR8SrTegHIi1sCK2OtNTQyRZg/v6yVkRDl nmr52oumop7xFxsx6vcZk3emfTsFbQ==
; This is a zone-signing key, keyid 42600, for lab.test.
; Created: 20260910122712 (Thu Sep 10 12:27:12 2026)
; Publish: 20260910122712 (Thu Sep 10 12:27:12 2026)
; Activate: 20260910122712 (Thu Sep 10 12:27:12 2026)
lab.test. IN DNSKEY 256 3 13 XGx8XP7w7bqg8k9cBXoPvDLsZQFUOAuUbdr8Bd8ZSH25ip1Bq75BGFYO yZhxy0DNqEsEPPpDt2qHAW/kdlJs3g==

# 構文チェック
$ sudo named-checkzone lab.test /etc/bind/db.lab.test

# Parentゾーンを署名
$ cd /etc/bind/keys/lab.test
$ sudo dnssec-signzone \
  -S \
  -o lab.test \
  -f /etc/bind/db.lab.test.signed \
  /etc/bind/db.lab.test
Verifying the zone using the following algorithms:
- ECDSAP256SHA256
Zone fully signed:
Algorithm: ECDSAP256SHA256: KSKs: 1 active, 0 stand-by, 0 revoked
                            ZSKs: 1 active, 0 stand-by, 0 revoked
/etc/bind/db.lab.test.signed

# 署名済みファイルを読み込むよう設定変更
# db.lab.test → db.lab.test.signed
$ sudo vim /etc/bind/named.conf.local
//
// Do any local configuration here
//

zone "lab.test" {
    type primary;
    file "/etc/bind/db.lab.test.signed";
};

# 設定をチェックして再読み込み
$ sudo named-checkconf
$ sudo rndc reconfig

# 本当に署名済みゾーンを読んでいるか確認
$ sudo rndc zonestatus lab.test
name: lab.test
type: primary
files: /etc/bind/db.lab.test.signed
serial: 2026091002
nodes: 4
last loaded: Thu, 10 Sep 2026 12:32:37 GMT
secure: yes
inline signing: no
key maintenance: none
next resign node: lab.test/DNSKEY
next resign time: Sat, 03 Oct 2026 11:32:37 GMT
dynamic: no
reconfigurable via modzone: no

# ParentのDNSKEYを直接確認
$ dig +dnssec @192.168.56.10 lab.test DNSKEY

; <<>> DiG 9.20.24-1ubuntu0.3-Ubuntu <<>> +dnssec @192.168.56.10 lab.test DNSKEY
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61863
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
; COOKIE: 3ad54fc7b29e4940010000006aa2a4c8a84d54b456af230d (good)
;; QUESTION SECTION:
;lab.test.                      IN      DNSKEY

;; ANSWER SECTION:
lab.test.               3600    IN      DNSKEY  256 3 13 XGx8XP7w7bqg8k9cBXoPvDLsZQFUOAuUbdr8Bd8ZSH25ip1Bq75BGFYO yZhxy0DNqEsEPPpDt2qHAW/kdlJs3g==
lab.test.               3600    IN      DNSKEY  257 3 13 nzPV3+LMX633npZfI3Seu2cR8SrTegHIi1sCK2OtNTQyRZg/v6yVkRDl nmr52oumop7xFxsx6vcZk3emfTsFbQ==
lab.test.               3600    IN      RRSIG   DNSKEY 13 2 3600 20261010113237 20260910113237 25095 lab.test. m/UN/LdqgXsjAQTzPkqY/72gzpJyLH5THJlrhrwhnXzvYPqZ29UIK7Dg yyR4y2kbghbxg2bsePGxUngUUoz4rw==
lab.test.               3600    IN      RRSIG   DNSKEY 13 2 3600 20261010113237 20260910113237 42600 lab.test. +c+NJo2m+DDpeUGVRfYZQxXKDe3MT/LfWspon14H8PTlJH+Z/JgH4XZG OIPaDr26IwXsqMt+lzPB809OeQ+SzA==

;; Query time: 0 msec
;; SERVER: 192.168.56.10#53(192.168.56.10) (UDP)
;; WHEN: Thu Sep 10 12:38:32 UTC 2026
;; MSG SIZE  rcvd: 433

# ParentのDSを直接確認
$ dig +dnssec +norecurse @192.168.56.10 child.lab.test DS

; <<>> DiG 9.20.24-1ubuntu0.3-Ubuntu <<>> +dnssec +norecurse @192.168.56.10 child.lab.test DS
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42626
;; flags: qr aa ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
; COOKIE: 5ab6af9666fe5062010000006aa2a50259f77941809ff655 (good)
;; QUESTION SECTION:
;child.lab.test.                        IN      DS

;; ANSWER SECTION:
child.lab.test.         3600    IN      DS      26145 13 2 C0F99483CDF9CE53B7EFBCE8607A73DCAA7B6FA728F24ECFEB01F653 2742BF5D
child.lab.test.         3600    IN      RRSIG   DS 13 3 3600 20261010113237 20260910113237 42600 lab.test. nAmsL7wGWZzUk27uPO/aSFuwSOwC1oQPrbsvkuJbKjHgvh1QZ6EN4x0v CTTAopk9zi9kDC1d/c++aNfBZYwSOA==

;; Query time: 0 msec
;; SERVER: 192.168.56.10#53(192.168.56.10) (UDP)
;; WHEN: Thu Sep 10 12:39:30 UTC 2026
;; MSG SIZE  rcvd: 223

Unboundに lab.test のTrust Anchorを設定して、DNSSEC検証を有効化

Resolver で作業。

Trust Anchor用のUnbound設定ファイルを作成する

# 専用ファイルを作成
# lab.test のDNSKEYは最初から信頼してよい と設定
$ sudo vim /etc/unbound/unbound.conf.d/lab-test-trust-anchor.conf
server:
    trust-anchor: "lab.test. IN DNSKEY 257 3 13 nzPV3+LMX633npZfI3Seu2cR8SrTegHIi1sCK2OtNTQyRZg/v6yVkRDl nmr52oumop7xFxsx6vcZk3emfTsFbQ=="

# domain-insecure: "lab.test." を削除
$ sudo vim /etc/unbound/unbound.conf.d/dns-lab.conf
server:
    interface: 192.168.56.30
    access-control: 192.168.56.0/24 allow

    local-zone: "test." transparent

stub-zone:
    name: "lab.test."
    stub-addr: 192.168.56.10

# Unboundの設定をチェックし、再読み込み
$ sudo unbound-checkconf
$ sudo systemctl restart unbound
$ sudo systemctl status unbound
● unbound.service - Unbound DNS server
     Loaded: loaded (/usr/lib/systemd/system/unbound.service; enabled; preset: enabled)
     Active: active (running) since Thu 2026-09-10 12:53:24 UTC; 4s ago

# Resolver自身からDNSSEC検証
$ dig +dnssec @192.168.56.30 www.child.lab.test A

; <<>> DiG 9.20.24-1ubuntu0.3-Ubuntu <<>> +dnssec @192.168.56.30 www.child.lab.test A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41055
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1　　# ad = Authenticated Data(UnboundがDNSSEC検証に成功し、応答をSecureとして扱った)

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;www.child.lab.test.            IN      A

;; ANSWER SECTION:
www.child.lab.test.     3600    IN      A       192.168.56.100
www.child.lab.test.     3600    IN      RRSIG   A 13 4 3600 20261009122536 20260909122536 7661 child.lab.test. XX27GC+TFLVYuz+Jd8Ox7SyC5yxL1ifF+cuSmi+J8jcqgW8NQhR+Fi8s FaHbAEZuw691gEoZ22rXmWlCL5sbOQ==　　# ChildのZSK(7661)によって署名されている

;; Query time: 13 msec
;; SERVER: 192.168.56.30#53(192.168.56.30) (UDP)
;; WHEN: Thu Sep 10 12:53:57 UTC 2026
;; MSG SIZE  rcvd: 173

Client → Unboundまで含めて正常に動作することを確認

Client で作業。

$ dig +dnssec @192.168.56.30 www.child.lab.test A

; <<>> DiG 9.20.24-1ubuntu0.3-Ubuntu <<>> +dnssec @192.168.56.30 www.child.lab.test A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50729
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1　　# Authenticated Data

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;www.child.lab.test.            IN      A

;; ANSWER SECTION:
www.child.lab.test.     3334    IN      A       192.168.56.100
www.child.lab.test.     3334    IN      RRSIG   A 13 4 3600 20261009122536 20260909122536 7661 child.lab.test. XX27GC+TFLVYuz+Jd8Ox7SyC5yxL1ifF+cuSmi+J8jcqgW8NQhR+Fi8s FaHbAEZuw691gEoZ22rXmWlCL5sbOQ==

;; Query time: 3 msec
;; SERVER: 192.168.56.30#53(192.168.56.30) (UDP)
;; WHEN: Thu Sep 10 12:58:23 UTC 2026
;; MSG SIZE  rcvd: 173

まとめ

以上で、UnboundのTrust Anchorを起点として、Parent DNSの lab.test からChild DNSの child.lab.test、最終的に www.child.lab.test のAレコードまでDNSSECによる信頼の連鎖を構築できた。Unboundからの応答には ad フラグが付与され、DNSSEC検証に成功していることも確認できた。次回は、この正常な状態を基準として、署名やDSレコードを意図的に破壊し、DNSSEC検証がどのように失敗するかを確認する。

セキュリティ 検証
BIND DNS DNSSEC Unbound
よかったらシェアしてね！
  • URLをコピーしました！
  • URLをコピーしました！

この記事を書いた人

miyukiのアバター miyuki

勉強中のセキュリティエンジニアです。
初心者の目線で学んだことをまとめています。

関連記事

コメント

コメントする

CAPTCHA


目次