DNSSEC validation requires that a DNS name server know the trust anchor key for the root DNS domain in order to validate already signed responses. In general, trust anchor keys do not change often, but they do change occasionally, and might change unexpectedly in the event the keys are compromised.
The FortiADC DNS server is preconfigured with a trust anchor key for the root DNS domain. If you are informed that you must update this key, you can use the configuration editor to paste the new content into the DNS server configuration.
Before you begin:
- You must have a good understanding of DNSSEC and knowledge of the DNS deployment in your network.
- You must have already obtained the key so that you can copy and paste it into the DNS server configuration.
- You must have Read-Write permission for Global Load Balance settings.
To configure the trust anchor key:
- Go to Global Load Balance > Zone Tools.
- Click the Trust Anchor Key tab.
- Click Create New to display the configuration editor.
- Complete the configuration as described in Trust anchor key configuration.
- Save the configuration.
Configuration name. Valid characters are
After you initially save the configuration, you cannot edit the name.
The key value. The key format is a string with the following format:
The following is an example:
Description for the key.