DNSSEC CONFIGURATION AND KEY MANAGEMENT ON A WINDOWS SERVER TEACHING TESTBED

This paper describes DNSSEC configuration and key management on a teaching testbed with two Windows Server virtual machines. One node hosts the authoritative lab.test zone, while the other processes queries using configured forwarding. The article presents zone creation, signing parameters, keys and signatures, trust-anchor configuration steps, and PowerShell responses. A query using DnssecOk returns A and RRSIG data after signing. This output demonstrates receipt of DNSSEC records but does not establish successful cryptographic verification of the signature or complete trust chain. A DNS server failure is displayed after re-signing and clearing the cache. The next listing shows an exported key file; importing that trust anchor and obtaining a successful query after import are not documented in the available material. Accordingly, neither the precise cause of the failure nor restored name resolution is treated as a verified result. Individual Wireshark frames illustrate response sizes for signed and unsigned zones, rather than average performance or a measurement series. Cited sources support discussion of KSK and ZSK rollover, RFC 5011, NSEC3, and the lack of DNS-query confidentiality. The practical scope is limited to the displayed commands, configurations, and responses. The material supports teaching and planning further trust-validation checks. It does not assess attack resistance, production availability, or successful operation of all validation mechanisms.