Domain Name System Security Extensions (DNSSEC) is an industry-standard protocol that functions as an extension to the Domain Name System (DNS) protocol. BIG-IP^® DNS uses DNSSEC to guarantee the authenticity of DNS responses, including zone transfers, and to return Denial of Existence responses thus protecting your network against DNS protocol and DNS server attacks.

BIG-IP^® DNS, formerly Global Traffic Manager™ (GTM™), uses two types of DNSSEC keys to return DNSSEC-compliant responses: a zone-signing key to sign all of the records in a DNSSEC resource record set, and a key-signing key to sign only the DNSKEY record (that is the zone-signing key) of a DNSSEC record set.

To enhance DNSSEC key security, when automatic key management is configured, BIG-IP^® DNS uses an automatic key rollover process that uses overlapping generations of a key to ensure that BIG-IP DNS can always respond to queries with DNSSEC-compliant responses. BIG-IP DNS dynamically creates new generations of each key based on the values of the Rollover Period and Expiration Period of the key.

The first generation of a key has an ID of 0 (zero). Each time BIG-IP DNS dynamically creates a new generation of a key, the ID increments by one. Over time, each generation of a key overlaps the previous generation of the key ensuring that BIG-IP DNS can respond to a DNSSEC query even if one generation of a key becomes unavailable. When a generation of a key expires, BIG-IP DNS automatically removes that generation of the key from the configuration. The value of the TTL (time-to-live) of a key specifies how long a client resolver can cache the key.

Overlapping generations of a key

Each DNSSEC zone has a list of read-only Security Entry Point (SEP) records. The BIG-IP^® DNS creates these records automatically when you create a zone. These SEP records consist of Delegation Signer (DS) and DNSKEY records.

You can use BIG-IP^® DNS to ensure that all responses to DNS-related traffic comply with the DNSSEC security protocol. To configure DNSSEC compliance, you create DNSSEC key-signing and zone-signing keys and a DNSSEC zone. Then you assign at least one enabled key-signing key and one enabled zone-signing key to the zone.

1. On the Main tab, click DNS > Delivery > Listeners .
   The Listeners List screen opens.
2. Click Create.
   The Listeners properties screen opens.
3. In the Name field, type a unique name for the listener.
4. For the Destination setting, in the Address field, type an IPv4 address on which BIG-IP DNS listens for network traffic.
5. In the Service area, from the Protocol list, select UDP.
6. Click Finished.

1. On the Main tab, click DNS > Delivery > Keys > DNSSEC Key List .
   The DNSSEC Key List screen opens.
2. Click Create.
   The New DNSSEC Key screen opens.
3. In the Name field, type a name for the key.
   Zone names are limited to 63 characters.
4. From the Type list, select Zone Signing Key.
5. From the State list, select Enabled.
6. From the Hardware Security Module list, select None.
7. From the Algorithm list, select the digest algorithm the system uses to generate the key signature. Your options are RSA/SHA1, RSA/SHA256, and RSA/SHA512.
8. From the Key Management list, select Automatic.
   The Key Settings area displays fields for key configuration.
9. In the Bit Width field, type 1024.
10. In the TTL field, accept the default value of 86400 (the number of seconds in one day.)
    This value specifies how long a client resolver can cache the key. This value must be less than the difference between the values of the rollover and expiration periods of the key; otherwise, a client can make a query and the system can send a valid key that the client cannot recognize.
11. For the Rollover Period setting, in the Days field, type 21.
12. For the Expiration Period setting, in the Days field, type 30.
    Zero seconds indicates not set, and thus the key does not expire.
13. For the Signature Validity Period setting, accept the default value of seven days.
    This value must be greater than the value of the signature publication period.
    Zero seconds indicates not set, and thus the server verifying the signature never succeeds, because the signature is always expired.
14. For the Signature Publication Period setting, accept the default value of four days and 16 hours.
    This value must be less than the value of the signature validity period.
    Zero seconds indicates not set, and thus the signature is not cached.
15. Click Finished.
16. To create a standby key for emergency rollover purposes, repeat these steps using a similar name, and select Disabled from the State list.

1. On the Main tab, click DNS > Delivery > Keys > DNSSEC Key List .
   The DNSSEC Key List screen opens.
2. Click Create.
   The New DNSSEC Key screen opens.
3. In the Name field, type a name for the key.
   Zone names are limited to 63 characters.
4. From the Type list, select Zone Signing Key.
5. From the State list, select Enabled.
6. From the Hardware Security Module list, select None.
7. From the Algorithm list, select the digest algorithm the system uses to generate the key signature. Your options are RSA/SHA1, RSA/SHA256, and RSA/SHA512.
8. From the Key Management list, select Manual.
   The Key Settings area displays Certificate and Private Key lists.
9. In the Key Settings area, select a certificate/key pair:
   1. From the Certificate list, select a certificate.
   2. From the Private Key list, select the key that matches the certificate you selected.
10. Click Finished.
11. To create a standby key for emergency rollover purposes, repeat these steps using a similar name, and select Disabled from the State list.

1. On the Main tab, click DNS > Delivery > Keys > DNSSEC Key List .
   The DNSSEC Key List screen opens.
2. Click Create.
   The New DNSSEC Key screen opens.
3. In the Name field, type a name for the key.
   Zone names are limited to 63 characters.
4. From the Type list, select Key Signing Key.
5. From the State list, select Enabled.
6. From the Hardware Security Module list, select None.
7. From the Algorithm list, select the digest algorithm the system uses to generate the key signature. Your options are RSA/SHA1, RSA/SHA256, and RSA/SHA512.
8. From the Key Management list, select Automatic.
   The Key Settings area displays fields for key configuration.
9. In the Bit Width field, type 2048.
10. In the TTL field, accept the default value of 86400 (the number of seconds in one day.)
    This value specifies how long a client resolver can cache the key. This value must be less than the difference between the values of the rollover and expiration periods of the key; otherwise, a client can make a query and the system can send a valid key that the client cannot recognize.
11. For the Rollover Period setting, in the Days field, type 340.
12. For the Expiration Period setting, in the Days field, type 365.
    Zero seconds indicates not set, and thus the key does not expire.
    Tip: The National Institute of Standards and Technology (NIST) recommends that a key-signing key expire once a year.
13. For the Signature Validity Period setting, accept the default value of seven days.
    This value must be greater than the value of the signature publication period.
    Zero seconds indicates not set, and thus the server verifying the signature never succeeds, because the signature is always expired.
14. For the Signature Publication Period setting, accept the default value of four days and 16 hours.
    This value must be less than the value of the signature validity period.
    Zero seconds indicates not set, and thus the signature is not cached.
15. Click Finished.
16. To create a standby key for emergency rollover purposes, repeat these steps using a similar name, and select Disabled from the State list.

1. On the Main tab, click DNS > Delivery > Keys > DNSSEC Key List .
   The DNSSEC Key List screen opens.
2. Click Create.
   The New DNSSEC Key screen opens.
3. In the Name field, type a name for the key.
   Zone names are limited to 63 characters.
4. From the Type list, select Key Signing Key.
5. From the State list, select Enabled.
6. From the Hardware Security Module list, select None.
7. From the Algorithm list, select the digest algorithm the system uses to generate the key signature. Your options are RSA/SHA1, RSA/SHA256, and RSA/SHA512.
8. From the Key Management list, select Manual.
   The Key Settings area displays Certificate and Private Key lists.
9. In the Key Settings area, select a certificate/key pair:
   1. From the Certificate list, select a certificate.
   2. From the Private Key list, select the key that matches the certificate you selected.
10. Click Finished.
11. To create a standby key for emergency rollover purposes, repeat these steps using a similar name, and select Disabled from the State list.

1. On the Main tab, click DNS > Zones > DNSSEC Zones .
   The DNSSEC Zone List screen opens.
2. Click Create.
   The New DNSSEC Zone screen opens.
3. In the Name field, type a domain name.
   For example, use a zone name of siterequest.com to handle DNSSEC requests for www.siterequest.com and *.www.siterequest.com.
4. From the State list, select Enabled.
5. For the Zone Signing Key setting, assign at least one enabled zone-signing key to the zone.
   You can associate the same zone-signing key with multiple zones.
6. For the Key Signing Key setting, assign at least one enabled key-signing key to the zone.
   You can associate the same key-signing key with multiple zones.
7. Click Finished.
   Even if you selected Enabled from the State list, if there are not at least one zone-signing and one key-signing key in the Active column, the status of the zone changes to offline.

1. Log on to the command-line interface of a client.
2. At the prompt, type: dig @<IP address of BIG-IP DNS listener> +dnssec <name of zone>
   BIG-IP DNS returns the signed RRSIG records for the zone.

1. On the Main tab, click DNS > Delivery > Listeners .
   The Listeners List screen opens.
2. Click Create.
   The Listeners properties screen opens.
3. In the Name field, type a unique name for the listener.
4. For the Destination setting, in the Address field, type an IPv4 address on which BIG-IP DNS listens for network traffic.
5. In the Service area, from the Protocol list, select UDP.
6. Click Finished.

1. On the Main tab, click DNS > Delivery > Keys > DNSSEC Key List .
   The DNSSEC Key List screen opens.
2. Click Create.
   The New DNSSEC Key screen opens.
3. In the Name field, type a name for the key.
   Zone names are limited to 63 characters.
4. From the Type list, select Zone Signing Key.
5. From the State list, select Enabled.
6. From the Hardware Security Module list, select External, if you use a network HSM.
7. From the Algorithm list, select the digest algorithm the system uses to generate the key signature. Your options are RSA/SHA1, RSA/SHA256, and RSA/SHA512.
8. From the Key Management list, select Automatic.
   Note: Only Thales HSM supports automatic key creation.
   The Key Settings area displays fields for key configuration.
9. In the Bit Width field, type 1024.
10. In the TTL field, accept the default value of 86400 (the number of seconds in one day.)
    This value specifies how long a client resolver can cache the key. This value must be less than the difference between the values of the rollover and expiration periods of the key; otherwise, a client can make a query and the system can send a valid key that the client cannot recognize.
11. For the Rollover Period setting, in the Days field, type 21.
12. For the Expiration Period setting, in the Days field, type 30.
    Zero seconds indicates not set, and thus the key does not expire.
13. For the Signature Validity Period setting, accept the default value of seven days.
    This value must be greater than the value of the signature publication period.
    Zero seconds indicates not set, and thus the server verifying the signature never succeeds, because the signature is always expired.
14. For the Signature Publication Period setting, accept the default value of four days and 16 hours.
    This value must be less than the value of the signature validity period.
    Zero seconds indicates not set, and thus the signature is not cached.
15. Click Finished.
16. To create a standby key for emergency rollover purposes, repeat these steps using a similar name, and select Disabled from the State list.

1. On the Main tab, click DNS > Delivery > Keys > DNSSEC Key List .
   The DNSSEC Key List screen opens.
2. Click Create.
   The New DNSSEC Key screen opens.
3. In the Name field, type a name for the key.
   Zone names are limited to 63 characters.
4. From the Type list, select Zone Signing Key.
5. From the State list, select Enabled.
6. From the Hardware Security Module list, select External, if you use a network HSM.
7. From the Algorithm list, select the digest algorithm the system uses to generate the key signature. Your options are RSA/SHA1, RSA/SHA256, and RSA/SHA512.
8. From the Key Management list, select Manual.
   The Key Settings area displays Certificate and Private Key lists.
9. In the Key Settings area, select a certificate/key pair:
   1. From the Certificate list, select a certificate.
   2. From the Private Key list, select the key that matches the certificate you selected.
10. Click Finished.
11. To create a standby key for emergency rollover purposes, repeat these steps using a similar name, and select Disabled from the State list.

1. On the Main tab, click DNS > Delivery > Keys > DNSSEC Key List .
   The DNSSEC Key List screen opens.
2. Click Create.
   The New DNSSEC Key screen opens.
3. In the Name field, type a name for the key.
   Zone names are limited to 63 characters.
4. From the Type list, select Key Signing Key.
5. From the State list, select Enabled.
6. From the Hardware Security Module list, select External, if you use a network HSM.
7. From the Algorithm list, select the digest algorithm the system uses to generate the key signature. Your options are RSA/SHA1, RSA/SHA256, and RSA/SHA512.
8. From the Key Management list, select Automatic.
   The Key Settings area displays fields for key configuration.
9. In the Bit Width field, type 2048.
10. In the TTL field, accept the default value of 86400 (the number of seconds in one day.)
    This value specifies how long a client resolver can cache the key. This value must be less than the difference between the values of the rollover and expiration periods of the key; otherwise, a client can make a query and the system can send a valid key that the client cannot recognize.
11. For the Rollover Period setting, in the Days field, type 340.
12. For the Expiration Period setting, in the Days field, type 365.
    Zero seconds indicates not set, and thus the key does not expire.
    Tip: The National Institute of Standards and Technology (NIST) recommends that a key-signing key expire once a year.
13. For the Signature Validity Period setting, accept the default value of seven days.
    This value must be greater than the value of the signature publication period.
    Zero seconds indicates not set, and thus the server verifying the signature never succeeds, because the signature is always expired.
14. For the Signature Publication Period setting, accept the default value of four days and 16 hours.
    This value must be less than the value of the signature validity period.
    Zero seconds indicates not set, and thus the signature is not cached.
15. Click Finished.
16. To create a standby key for emergency rollover purposes, repeat these steps using a similar name, and select Disabled from the State list.

1. On the Main tab, click DNS > Delivery > Keys > DNSSEC Key List .
   The DNSSEC Key List screen opens.
2. Click Create.
   The New DNSSEC Key screen opens.
3. In the Name field, type a name for the key.
   Zone names are limited to 63 characters.
4. From the Type list, select Key Signing Key.
5. From the State list, select Enabled.
6. From the Hardware Security Module list, select External, if you use a network HSM.
7. From the Algorithm list, select the digest algorithm the system uses to generate the key signature. Your options are RSA/SHA1, RSA/SHA256, and RSA/SHA512.
8. From the Key Management list, select Manual.
   The Key Settings area displays Certificate and Private Key lists.
9. In the Key Settings area, select a certificate/key pair:
   1. From the Certificate list, select a certificate.
   2. From the Private Key list, select the key that matches the certificate you selected.
10. Click Finished.
11. To create a standby key for emergency rollover purposes, repeat these steps using a similar name, and select Disabled from the State list.

1. On the Main tab, click DNS > Zones > DNSSEC Zones .
   The DNSSEC Zone List screen opens.
2. Click Create.
   The New DNSSEC Zone screen opens.
3. In the Name field, type a domain name.
   For example, use a zone name of siterequest.com to handle DNSSEC requests for www.siterequest.com and *.www.siterequest.com.
4. From the State list, select Enabled.
5. For the Zone Signing Key setting, assign at least one enabled zone-signing key to the zone.
   You can associate the same zone-signing key with multiple zones.
6. For the Key Signing Key setting, assign at least one enabled key-signing key to the zone.
   You can associate the same key-signing key with multiple zones.
7. Click Finished.
   Even if you selected Enabled from the State list, if there are not at least one zone-signing and one key-signing key in the Active column, the status of the zone changes to offline.

1. Log on to the command-line interface of a client.
2. At the prompt, type: dig @<IP address of BIG-IP DNS listener> +dnssec <name of zone>
   BIG-IP DNS returns the signed RRSIG records for the zone.

1. On the Main tab, click DNS > Delivery > Listeners .
   The Listeners List screen opens.
2. Click Create.
   The Listeners properties screen opens.
3. In the Name field, type a unique name for the listener.
4. For the Destination setting, in the Address field, type an IPv4 address on which BIG-IP DNS listens for network traffic.
5. In the Service area, from the Protocol list, select UDP.
6. Click Finished.

1. On the Main tab, click DNS > Delivery > Keys > DNSSEC Key List .
   The DNSSEC Key List screen opens.
2. Click Create.
   The New DNSSEC Key screen opens.
3. In the Name field, type a name for the key.
   Zone names are limited to 63 characters.
4. From the Type list, select Zone Signing Key.
5. From the State list, select Enabled.
6. From the Hardware Security Module list, select Internal, if you use a FIPs internal HSM card.
7. From the Algorithm list, select the digest algorithm the system uses to generate the key signature. Your options are RSA/SHA1, RSA/SHA256, and RSA/SHA512.
8. From the Key Management list, select Automatic.
   The Key Settings area displays fields for key configuration.
9. In the Bit Width field, type 1024.
10. In the TTL field, accept the default value of 86400 (the number of seconds in one day.)
    This value specifies how long a client resolver can cache the key. This value must be less than the difference between the values of the rollover and expiration periods of the key; otherwise, a client can make a query and the system can send a valid key that the client cannot recognize.
11. For the Rollover Period setting, in the Days field, type 21.
12. For the Expiration Period setting, in the Days field, type 30.
    Zero seconds indicates not set, and thus the key does not expire.
13. For the Signature Validity Period setting, accept the default value of seven days.
    This value must be greater than the value of the signature publication period.
    Zero seconds indicates not set, and thus the server verifying the signature never succeeds, because the signature is always expired.
14. For the Signature Publication Period setting, accept the default value of four days and 16 hours.
    This value must be less than the value of the signature validity period.
    Zero seconds indicates not set, and thus the signature is not cached.
15. Click Finished.
16. To create a standby key for emergency rollover purposes, repeat these steps using a similar name, and select Disabled from the State list.

1. On the Main tab, click DNS > Delivery > Keys > DNSSEC Key List .
   The DNSSEC Key List screen opens.
2. Click Create.
   The New DNSSEC Key screen opens.
3. In the Name field, type a name for the key.
   Zone names are limited to 63 characters.
4. From the Type list, select Key Signing Key.
5. From the State list, select Enabled.
6. From the Hardware Security Module list, select Internal, if you use a FIPs internal HSM card.
7. From the Algorithm list, select the digest algorithm the system uses to generate the key signature. Your options are RSA/SHA1, RSA/SHA256, and RSA/SHA512.
8. From the Key Management list, select Automatic.
   The Key Settings area displays fields for key configuration.
9. In the Bit Width field, type 2048.
10. In the TTL field, accept the default value of 86400 (the number of seconds in one day.)
    This value specifies how long a client resolver can cache the key. This value must be less than the difference between the values of the rollover and expiration periods of the key; otherwise, a client can make a query and the system can send a valid key that the client cannot recognize.
11. For the Rollover Period setting, in the Days field, type 340.
12. For the Expiration Period setting, in the Days field, type 365.
    Zero seconds indicates not set, and thus the key does not expire.
    Tip: The National Institute of Standards and Technology (NIST) recommends that a key-signing key expire once a year.
13. For the Signature Validity Period setting, accept the default value of seven days.
    This value must be greater than the value of the signature publication period.
    Zero seconds indicates not set, and thus the server verifying the signature never succeeds, because the signature is always expired.
14. For the Signature Publication Period setting, accept the default value of four days and 16 hours.
    This value must be less than the value of the signature validity period.
    Zero seconds indicates not set, and thus the signature is not cached.
15. Click Finished.
16. To create a standby key for emergency rollover purposes, repeat these steps using a similar name, and select Disabled from the State list.

1. On the Main tab, click DNS > Zones > DNSSEC Zones .
   The DNSSEC Zone List screen opens.
2. Click Create.
   The New DNSSEC Zone screen opens.
3. In the Name field, type a domain name.
   For example, use a zone name of siterequest.com to handle DNSSEC requests for www.siterequest.com and *.www.siterequest.com.
4. From the State list, select Enabled.
5. For the Zone Signing Key setting, assign at least one enabled zone-signing key to the zone.
   You can associate the same zone-signing key with multiple zones.
6. For the Key Signing Key setting, assign at least one enabled key-signing key to the zone.
   You can associate the same key-signing key with multiple zones.
7. Click Finished.
   Even if you selected Enabled from the State list, if there are not at least one zone-signing and one key-signing key in the Active column, the status of the zone changes to offline.

1. Log on to the command-line interface of a client.
2. At the prompt, type: dig @<IP address of BIG-IP DNS listener> +dnssec <name of zone>
   BIG-IP DNS returns the signed RRSIG records for the zone.

In this figure, a zone is hosted on an authoritative DNS server, that is not secured with DNSSEC keys. An administrator at Site Request creates a DNS zone with a DNS Express™ server and a DNSSEC zone with DNSSEC keys. The name of both zones on the BIG-IP system match the name of the zone on the authoritative DNS server. The creation of the DNS zone initiates an unsigned zone transfer request from DNS Express to the authoritative DNS server that hosts the zone. The server responds with an unsigned zone transfer and the zone is loaded into DNS Express as an unsigned zone.

Unsigned DNS zone transfer to DNS Express

1. Creation of DNS zone with DNS Express server initiates unsolicited zone transfer request from DNS Express to authoritative DNS server.
2. DNS server responds with unsigned zone transfer to DNS Express, which loads the zone, and stores it as an unsigned zone.

In this figure, when the zone is updated, the zone transfer from the server to DNS Express is unsigned. The zone is stored in DNS Express as an unsigned zone. However, when the BIG-IP system receives a zone transfer request, the system signs the zone transfer using DNSSEC keys and sends the signed zone transfer to a DNS nameserver (client).

BIG-IP responds to zone transfer request with DNSSEC-signed response

1. When a zone update occurs, DNS server sends NOTIFY message to DNS Express.
2. DNS Express sends zone transfer request to DNS server.
3. DNS server responds with zone transfer to DNS Express
4. DNS Express stores unsigned zone.
5. DNS Express sends NOTIFY to DNS nameserver client.
6. Client sends zone transfer request to DNS Express.
7. DNS Express responds with DNSSEC-signed zone transfer.

In this figure, a zone is hosted on an authoritative DNS server, that is not secured with DNSSEC. The BIG-IP^® system is configured with both a DNS zone and a DNSSEC zone that match the zone name on the server. The system can forward zone transfer requests to the DNS server, and then sign the response with DNSSEC keys, before sending the response to the client (authoritative DNS nameservers (clients) and cloud providers). This allows the clients and cloud providers to serve DNSSEC-signed DNS queries and responses.

The BIG-IP system configured with DNS zone proxy and DNSSEC zone

1. DNS nameserver (client) sends zone transfer request for a DNS zone.
2. The BIG-IP system forwards the request to the authoritative DNS server.
3. DNS server answers with zone transfer.
4. The BIG-IP system signs the zone transfer with DNSSEC keys.
5. The BIG-IP system sends the DNSSEC-signed zone transfer to the client that made the request.

In this figure, a zone is hosted on a pool of authoritative DNS servers. The servers are not secured with DNSSEC. The BIG-IP^® system is configured with both a DNS zone and a DNSSEC zone that match the zone name on the servers. The BIG-IP system can forward zone transfer requests to a pool member, and then sign the response with DNSSEC keys, before sending the DNSSEC-signed zone transfer to the client (authoritative DNS nameserver or cloud provider). This allows the clients and cloud providers to serve DNSSEC-signed DNS queries and responses.

BIG-IP load balancing zone transfer request to pool member and returning DNSSEC-signed zone transfer

1. DNS nameserver (client) or cloud provider sends zone transfer request for a DNS zone.
2. BIG-IP forwards the request to a member of the pool of authoritative DNS servers that host the zone.
3. The pool member responds with a zone transfer.
4. BIG-IP signs the zone transfer with DNSSEC keys.
5. BIG-IP sends the DNSSEC-signed zone transfer to the client that made the request.

1. On the Main tab, click DNS > Delivery > Profiles > DNS .
   The DNS profile list screen opens.
2. Click Create.
   The New DNS Profile screen opens.
3. In the Name field, type a unique name for the profile.
4. Select the Custom check box.
5. In the DNS Traffic area, from the Zone Transfer list, select Enabled.
6. In the DNS Features area, from the Use BIND Server on BIG-IP list, select Disabled.
7. Click Finished.

1. On the Main tab, click DNS > Delivery > Listeners .
   The Listeners List screen opens.
2. Click the name of the listener you want to modify.
3. In the Service area, from the DNS Profile list, select the custom DNS profile with Zone Transfer enabled, and Use BIND server on BIG-IP disabled.
4. Click Finished.
5. Perform steps 2 - 4 to modify each of the other listeners.

1. On the Main tab, click DNS > Delivery > Keys > DNSSEC Key List .
   The DNSSEC Key List screen opens.
2. Click Create.
   The New DNSSEC Key screen opens.
3. In the Name field, type a name for the key.
   Zone names are limited to 63 characters.
4. From the Type list, select Zone Signing Key.
5. From the State list, select Enabled.
6. From the Hardware Security Module list, select None.
7. From the Algorithm list, select the digest algorithm the system uses to generate the key signature. Your options are RSA/SHA1, RSA/SHA256, and RSA/SHA512.
8. From the Key Management list, select Automatic.
   The Key Settings area displays fields for key configuration.
9. In the Bit Width field, type 1024.
10. In the TTL field, accept the default value of 86400 (the number of seconds in one day.)
    This value specifies how long a client resolver can cache the key. This value must be less than the difference between the values of the rollover and expiration periods of the key; otherwise, a client can make a query and the system can send a valid key that the client cannot recognize.
11. For the Rollover Period setting, in the Days field, type 21.
12. For the Expiration Period setting, in the Days field, type 30.
    Zero seconds indicates not set, and thus the key does not expire.
13. For the Signature Validity Period setting, accept the default value of seven days.
    This value must be greater than the value of the signature publication period.
    Zero seconds indicates not set, and thus the server verifying the signature never succeeds, because the signature is always expired.
14. For the Signature Publication Period setting, accept the default value of four days and 16 hours.
    This value must be less than the value of the signature validity period.
    Zero seconds indicates not set, and thus the signature is not cached.
15. Click Finished.
16. To create a standby key for emergency rollover purposes, repeat these steps using a similar name, and select Disabled from the State list.

1. On the Main tab, click DNS > Delivery > Keys > DNSSEC Key List .
   The DNSSEC Key List screen opens.
2. Click Create.
   The New DNSSEC Key screen opens.
3. In the Name field, type a name for the key.
   Zone names are limited to 63 characters.
4. From the Type list, select Zone Signing Key.
5. From the State list, select Enabled.
6. From the Hardware Security Module list, select None.
7. From the Algorithm list, select the digest algorithm the system uses to generate the key signature. Your options are RSA/SHA1, RSA/SHA256, and RSA/SHA512.
8. From the Key Management list, select Manual.
   The Key Settings area displays Certificate and Private Key lists.
9. In the Key Settings area, select a certificate/key pair:
   1. From the Certificate list, select a certificate.
   2. From the Private Key list, select the key that matches the certificate you selected.
10. Click Finished.
11. To create a standby key for emergency rollover purposes, repeat these steps using a similar name, and select Disabled from the State list.

1. On the Main tab, click DNS > Delivery > Keys > DNSSEC Key List .
   The DNSSEC Key List screen opens.
2. Click Create.
   The New DNSSEC Key screen opens.
3. In the Name field, type a name for the key.
   Zone names are limited to 63 characters.
4. From the Type list, select Key Signing Key.
5. From the State list, select Enabled.
6. From the Hardware Security Module list, select None.
7. From the Algorithm list, select the digest algorithm the system uses to generate the key signature. Your options are RSA/SHA1, RSA/SHA256, and RSA/SHA512.
8. From the Key Management list, select Automatic.
   The Key Settings area displays fields for key configuration.
9. In the Bit Width field, type 2048.
10. In the TTL field, accept the default value of 86400 (the number of seconds in one day.)
    This value specifies how long a client resolver can cache the key. This value must be less than the difference between the values of the rollover and expiration periods of the key; otherwise, a client can make a query and the system can send a valid key that the client cannot recognize.
11. For the Rollover Period setting, in the Days field, type 340.
12. For the Expiration Period setting, in the Days field, type 365.
    Zero seconds indicates not set, and thus the key does not expire.
    Tip: The National Institute of Standards and Technology (NIST) recommends that a key-signing key expire once a year.
13. For the Signature Validity Period setting, accept the default value of seven days.
    This value must be greater than the value of the signature publication period.
    Zero seconds indicates not set, and thus the server verifying the signature never succeeds, because the signature is always expired.
14. For the Signature Publication Period setting, accept the default value of four days and 16 hours.
    This value must be less than the value of the signature validity period.
    Zero seconds indicates not set, and thus the signature is not cached.
15. Click Finished.
16. To create a standby key for emergency rollover purposes, repeat these steps using a similar name, and select Disabled from the State list.

1. On the Main tab, click DNS > Delivery > Keys > DNSSEC Key List .
   The DNSSEC Key List screen opens.
2. Click Create.
   The New DNSSEC Key screen opens.
3. In the Name field, type a name for the key.
   Zone names are limited to 63 characters.
4. From the Type list, select Key Signing Key.
5. From the State list, select Enabled.
6. From the Hardware Security Module list, select None.
7. From the Algorithm list, select the digest algorithm the system uses to generate the key signature. Your options are RSA/SHA1, RSA/SHA256, and RSA/SHA512.
8. From the Key Management list, select Manual.
   The Key Settings area displays Certificate and Private Key lists.
9. In the Key Settings area, select a certificate/key pair:
   1. From the Certificate list, select a certificate.
   2. From the Private Key list, select the key that matches the certificate you selected.
10. Click Finished.
11. To create a standby key for emergency rollover purposes, repeat these steps using a similar name, and select Disabled from the State list.

1. On the Main tab, click DNS > Zones > DNSSEC Zones .
   The DNSSEC Zone List screen opens.
2. Click Create.
   The New DNSSEC Zone screen opens.
3. In the Name field, type a domain name.
   For example, use a zone name of siterequest.com to handle DNSSEC requests for www.siterequest.com and *.www.siterequest.com.
4. From the State list, select Enabled.
5. For the Zone Signing Key setting, assign at least one enabled zone-signing key to the zone.
   You can associate the same zone-signing key with multiple zones.
6. For the Key Signing Key setting, assign at least one enabled key-signing key to the zone.
   You can associate the same key-signing key with multiple zones.
7. Click Finished.
   Even if you selected Enabled from the State list, if there are not at least one zone-signing and one key-signing key in the Active column, the status of the zone changes to offline.

1. On the Main tab, click DNS > Delivery > Nameservers .
   The Nameservers List screen opens.
2. Click Create.
   The New Nameserver screen opens.
3. In the Name field, type a name for the authoritative DNS server.
4. In the Address field, type the IP address on which the DNS server listens for DNS messages.
5. Optional: From the Server Key list, select the TSIG key that matches the TSIG key on the DNS server.
   The BIG-IP system uses this TSIG key to sign DNS zone transfer requests sent to the DNS server that hosts this zone, and then to verify a zone transfer returned from the DNS server.

1. On the Main tab, click DNS > Delivery > Nameservers .
   The Nameservers List screen opens.
2. Click Create.
   The New Nameserver screen opens.
3. In the Name field, type a name for the DNS nameserver (client).
4. In the Address field, type the IP address on which the DNS nameserver (client) listens for DNS messages.
5. Optional: From the TSIG Key list, select the TSIG key you want the BIG-IP system to use to validate zone transfer traffic.
6. Click Finished.
7. Add nameserver objects to represent other DNS nameservers (clients).

1. On the Main tab, click DNS > Zones .
   The Zone List screen opens.
2. Click the name of the zone you want to modify.
3. In the Zone Transfer Clients area, move the nameservers that can initiate zone transfers from the Available list to the Active list.
4. Click Finished.

1. On the Main tab, click Statistics > Module Statistics > DNS > Zones .
   The Zones statistics screen opens.
2. From the Statistics Type list, select Zones.
   Information displays about the traffic handled by the DNSSEC zones in the list.
3. In the Details column for a zone, click View.
   Read the online help for an explanation of the statistics.

1. On the Main tab, click DNS > Zones > DNSSEC Zones .
   The DNSSEC Zone List screen opens.
2. Click the name of the DNSSEC zone for which you want to view or copy SEP records.
3. On the menu bar, click SEP Records.
   The SEP records display for each generation of a key. If the SEP record screen is unexpectedly blank, ensure that at least one data center and a server representing the BIG-IP DNS device exist in the BIG-IP system configuration.
4. From the Generation list, select a generation of the key-signing key.
   The DS Record and DNSKEY Record fields display read-only Security Entry Point (SEP) records, specifically the DS (Delegation Signer) and DNSKey records.

1. On the Main tab, click DNS > Delivery > Keys > DNSSEC Key List .
   The DNSSEC Key List screen opens.
2. Click a number in the Generations column.
   Information about this generation of the key displays.

   Column Title	Contains
   ID	Generation number of the key
   Key Tag	Identifier (hash) of this generation of the key
   Creator	Host name of BIG-IP DNS that created this generation of the key
   Rollover Time	Time this generation of the key will roll over
   Expiration Time	Time this generation of the key will expire

3. Click the number in the ID column.
   The general properties of the generation of the key display.
4. Select Specify from the Rollover Time list, and then select the exact time that you want the BIG-IP system to create and begin to use a new generation of this key.
   Modifying this setting does not affect the value of the rollover and expiration periods of the key.
5. Select Specify from the Expiration Time list, and then select the exact time that you want this generation of the key to expire.
   Modifying this setting does not affect the value of the rollover and expiration periods of the key.
6. Click Update.