In Progress No DNSSEC on cPanel subdomains

Operating System & Version
CloudLinux 7
cPanel & WHM Version
92

DennisMidjord

Well-Known Member
Sep 27, 2016
280
43
78
Denmark
cPanel Access Level
Root Administrator
Okay, this might be difficult for me to explain, but I hope it's understandable.

We've just configured DNSSEC for our primary domain (let's use example.com as an example). DNSSEC for example.com was fully working.
After a while, a customer contacted us, stating they had issues with accessing cPanel on server1.example.com - and looking into it, server1.example.com didn't even respond to DNS queries because the domain wasn't configured with DNSSEC keys.

Disabling DNSSEC on example.com fixed the issue (after a few minutes).
Why is it that no keys are setup for the subdomains that we use for cPanel? What do we need to do to fix this?
 

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
7,519
1,027
313
cPanel Access Level
Root Administrator
Hey there! Did the subdomains have a unique zone file from the parent domain? As in, did sub.domain.com had a separate zone file than domain.com? If so, we have an article on how to make sure those get setup with DNSSEC here:


You can check the DNSSEC setup using the details here:


Let me know if that isn't exactly what you were experiencing and I can try and get you more applicable information.
 

DennisMidjord

Well-Known Member
Sep 27, 2016
280
43
78
Denmark
cPanel Access Level
Root Administrator
Did the subdomains have a unique zone file from the parent domain?
Yeah, they do. Is there any way to not have this done? It seems that cPanel does this automatically when we setup the server.

Edit: Oh, I actually see that it's apparently only one server that has it's own zone (server1.example.com). We have a lot of other servers where this is not the case. How come?
 

DennisMidjord

Well-Known Member
Sep 27, 2016
280
43
78
Denmark
cPanel Access Level
Root Administrator
Alright, I might need a bit more of your help, @cPRex.
Our name servers are on the same domain as our "main" domain (example.com). These are called ns1.example.com, ns2.example.com and ns3.example.com.
How would we define DS keys for those? Wouldn't it cause loops if we defined NS records for ns1, ns2 and ns3 in the example.com zone and pointed them to... well, ns1, ns2 and ns3?

Couldn't we just remove the zones for ns1, ns2 and ns3? A and AAAA records are defined for these in the example.com zone.

I tried to define DS records in the example.com zone, but I couldn't select anything but 1-Sha-1 as digest type, no matter what algorithm I chose.
 
Last edited:

DennisMidjord

Well-Known Member
Sep 27, 2016
280
43
78
Denmark
cPanel Access Level
Root Administrator
Yes, I always recommend removing zone files that are just for the nameservers and managing everything through the main "domain.com" zone.
Alright, I'll work on that tomorrow. Thanks! What's the reason that some servers has their own zone file created (eg. our server1.example.com and ns1, ns2 and ns3)?
Can you get me more details on the digest type issue so I can test that?
Yes, sure. See this gif: https://i.imgur.com/iRAkGZr.gif
 

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
7,519
1,027
313
cPanel Access Level
Root Administrator
For the nameserver question, let's use ns1.domain.com as an example. If you have this nameserver setup in WHM, but you have not created domain.com on the system yet, clicking the "Conifgure address records" button in the WHM >> Basic WebHost Manager Setup page will create the ns1.domain.com zone files. This allows them to resolve in DNS even without the main domain.com zone existing.

Videos and screenshots? All the time. But this is my first gif in many years of support :D

The DS record gets based off the DNSSEC key that was originally created, so it's possible that is the only digest available for your particular key.
 

DennisMidjord

Well-Known Member
Sep 27, 2016
280
43
78
Denmark
cPanel Access Level
Root Administrator
The DS record gets based off the DNSSEC key that was originally created, so it's possible that is the only digest available for your particular key.
I'm just generating everything through cPanel.
I went to the server1.example.com DNSSEC management interface, created the keys. Then I went to example.com zone, set NS records for server1 to point to ns1.example.com, ns2.example.com and ns3.example.com. After this, I tried creating the DS keys - but I couldn't choose the right algorithm.
I'm still having that issue.

I'm also not able to see any of the existing DS records for our root domain (example.com) through WHM > Zone Manager.
When looking in the DNS zone file on our name server, I see that the DS records are configured like this:
Code:
example.com.    86400   IN      TYPE257 \# 17 <hidden>
example.com.    86400   IN      TYPE257 \# 19 <hidden>
If I create a new DS record, it's appearing as DS instead of TYPE257.
 

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
7,519
1,027
313
cPanel Access Level
Root Administrator
I also am only seeing one option on the dropdown when I do my testing. I'm going to speak with our developers on this to see if they can get me more details on how that is supposed to work, or if this is an issue with the interface. It might be a bit before I hear back, but I'll mark this ticket as "In Progress" so I don't miss it. I'll update it as soon as I get a reply, but it might be a few days, especially with the weekend coming up.

It's also worth noting that you can still see the automatically-created DS records within the DNSKEYS area of the Zone Editor in cPanel, so if you need to copy those over to your registrar you can.