In Virtualmin → DNS Settings → DNS Options, when “TLSA records enabled” is set to yes but “DNSSEC signature enabled” is set to no, it causes Virtualmin → Systems Settings → Re-check Configuration to display the 'Your system is not ready to be used by Virtualmin".
When “TLSA records enabled” is set to no for all virtual servers, Re-check Configuration shows the usual " … your system is ready for use by Virtualmin message.
Perhaps “TLSA records enabled” should be greyed out if “DNSSEC signature enabled” is set to no?
It is Bind which objects, when that happens, in Re-check Configuration. If we wish to offer this permutation to Virtualmin users, can Recheck Configuration be made to ignore the warnings generated by Bind and go on to the next set of checks that Recheck Configuration performs?
And if not, then as long as Bind generates the warning, that permutation cannot be offered.
Oh, I should also mention that Check BIND Config throws no errors or warnings when we add TLSA records even if DNSSEC isn’t enabled.
Checking Configuration
The status of your system is being checked to ensure that all enabled features are available and properly configured ..
Your system has 5.78 GiB of memory, which is at or above the Virtualmin recommended minimum of 256 MiB
Errors were found in your system's BIND configuration : /var/lib/bind/beehivesoftware.indiax.com.hosts:8: ignoring out-of-zone data (beehivesoftware.indiax.com), /var/lib/bind/beehivesoftware.indiax.com.hosts:9: ignoring out-of-zone data (beehivesoftware.indiax.com), zone beehivesoftware.indiax.com.disabled/IN: has no NS records, zone beehivesoftware.indiax.com.disabled/IN: not loaded due to errors., _default/beehivesoftware.indiax.com.disabled/IN: bad zone, /var/lib/bind/sumdiagnostics.in.hosts:28: ignoring out-of-zone data (_443._tcp.sumdiagnostics.indiax.com), /var/lib/bind/sumdiagnostics.in.hosts:29: ignoring out-of-zone data (_443._tcp.www.sumdiagnostics.indiax.com), /var/lib/bind/sumdiagnostics.in.hosts:30: ignoring out-of-zone data (_443._tcp.admin.sumdiagnostics.indiax.com), /var/lib/bind/sumdiagnostics.in.hosts:31: ignoring out-of-zone data (_443._tcp.webmail.sumdiagnostics.indiax.com)
.. your system is not ready for use by Virtualmin
So:
/var/lib/bind/sumdiagnostics.in.hosts:28: ignoring out-of-zone data (_443._tcp.sumdiagnostics.indiax.com)
Edit: and I did something stupid a few minutes ago. While we were discussing this, I disabled TLSA for sumdiagnostics and then enabled it again, and in doing so removed the old records in sumdiagnostics.in.hosts which might have been of help to you to diagnose this. Sorry!
Edit: after i enabled TLSA again, I still see:
Checking Configuration
The status of your system is being checked to ensure that all enabled features are available and properly configured ..
Your system has 5.78 GiB of memory, which is at or above the Virtualmin recommended minimum of 256 MiB
Errors were found in your system's BIND configuration : /var/lib/bind/beehivesoftware.indiax.com.hosts:8: ignoring out-of-zone data (beehivesoftware.indiax.com), /var/lib/bind/beehivesoftware.indiax.com.hosts:9: ignoring out-of-zone data (beehivesoftware.indiax.com), zone beehivesoftware.indiax.com.disabled/IN: has no NS records, zone beehivesoftware.indiax.com.disabled/IN: not loaded due to errors., _default/beehivesoftware.indiax.com.disabled/IN: bad zone, /var/lib/bind/sumdiagnostics.in.hosts:28: ignoring out-of-zone data (_443._tcp.sumdiagnostics.indiax.com), /var/lib/bind/sumdiagnostics.in.hosts:29: ignoring out-of-zone data (_443._tcp.www.sumdiagnostics.indiax.com), /var/lib/bind/sumdiagnostics.in.hosts:30: ignoring out-of-zone data (_443._tcp.admin.sumdiagnostics.indiax.com), /var/lib/bind/sumdiagnostics.in.hosts:31: ignoring out-of-zone data (_443._tcp.webmail.sumdiagnostics.indiax.com)
Edit: but when I restart BIND, I see:
Check BIND Config
The following errors were found in the BIND configuration file /etc/bind/named.conf or referenced zone files ..
/var/lib/bind/beehivesoftware.indiax.com.hosts:8: ignoring out-of-zone data (beehivesoftware.indiax.com)
/var/lib/bind/beehivesoftware.indiax.com.hosts:9: ignoring out-of-zone data (beehivesoftware.indiax.com)
zone beehivesoftware.indiax.com.disabled/IN: has no NS records
zone beehivesoftware.indiax.com.disabled/IN: not loaded due to errors.
_default/beehivesoftware.indiax.com.disabled/IN: bad zone
/var/lib/bind/sumdiagnostics.in.hosts:28: ignoring out-of-zone data (_443._tcp.sumdiagnostics.indiax.com)
/var/lib/bind/sumdiagnostics.in.hosts:29: ignoring out-of-zone data (_443._tcp.www.sumdiagnostics.indiax.com)
/var/lib/bind/sumdiagnostics.in.hosts:30: ignoring out-of-zone data (_443._tcp.admin.sumdiagnostics.indiax.com)
/var/lib/bind/sumdiagnostics.in.hosts:31: ignoring out-of-zone data (_443._tcp.webmail.sumdiagnostics.indiax.com)
Is this an edge case caused by my workflow? I create a virtual server with the client’s domain (sumdiagnostics.in - which is still hosted somewhere else) and I alias it with a temporary domain used during development (sumdiagnostics.indiax.com - which is on my Virtualmin server, naturally). DNS records are created automatically by Virtualmin. However, when I remove the temporary domain and make the client’s website live on the clients domains by pointing its DNS to Virtualmin’s DNS, the cleanup by Virtualmin for the removal of sumdiagnostics.indiax.com is not perfect?
Thanks for that file! I see the issue now, and will fix it in the next Virtualmin release.
The trigger is having an SSL certificate for multiple domain names, in this case sumdiagnostics.in and indiax.com … it’s not actually related to DNSSEC at all.