Main configuration file:/etc/bind/named.conf.options

Zone names file:/etc/bind/named.conf.local

Default zone file location:/var/cache/bind/

vi /etc/bind/named.conf.options =>

dnssec-enable yes;

dnssec-validation yes;

dnssec-lookaside auto;

cd /etc/bind/zones

dnssec-keygen -a NSEC3RSASHA1 -b 2048 -n ZONE example.com # Create Zones signing key

install haveged otherwise it will take too long

dnssec-keygen -f KSK -a NSEC3RSASHA1 -b 4096 -n ZONE example.com # Create a Key Signing Key

Directory will have 2 key pairs.

echo example.com.public.keys>> db.example.com #add both public keys which contain the DNSKEY record to the zone file

dnssec-signzone -3 -A -N INCREMENT -o -t # Sign the zone   

dnssec-signzone -A -3 $(head -c 1000 /dev/random | sha1sum | cut -b 1-16) -N INCREMENT -o example.com -t db.example.com  # Sign the zone 

vi  /etc/bind/named.conf.local =>

 file "db.example.com.signed"; Change the file pointers to .signed files