DNSSEC: say where the DS record really goes

The DNSSEC tab said "give this to your registrar" for every zone whose
parent wasn't in Jarl in the same view. The DNSSEC response now has
ds_at/ds_place/ds_note: the parent zone in Jarl (any view, its own
first, then a public one), the registrar for a registered domain, the
parent zone wherever it is hosted for a subdomain, the ISP or RIR for a
reverse zone, and nowhere for a private name. The page and the CLI use
them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/jarl/dnssec.go

@@ -23,8 +23,8 @@ keeps writing the unsigned zone, and named keeps a signed copy next to it
 and its keys in Jarl's key directory. See docs/dnssec.md.
 
 Turning signing on is safe at any time; validation only starts once you add
-the zone's DS record at the parent zone (your registrar), and 'status' says
-when that is safe. Turning it off goes through BIND's insecure policy, which
+the zone's DS record at the parent zone (your registrar for a domain, the
+parent zone for a subdomain), and 'status' says when that is safe and where. Turning it off goes through BIND's insecure policy, which
 keeps the zone signed until the DS is gone from the parent.`,
 	}
 	var view string
@@ -71,7 +71,7 @@ DS after that.`,
 				return err
 			}
 			if !flagQuiet {
-				fmt.Printf("\nnamed is signing %s now. Add the DS record at your registrar only when\n'jarl zone dnssec status %s' says the zone is ready.\n", strings.TrimSuffix(args[0], "."), args[0]+viewFlag(view))
+				fmt.Printf("\nnamed is signing %s now. Add its DS record to the parent zone only when\n'jarl zone dnssec status %s' says the zone is ready; it also says where it goes.\n", strings.TrimSuffix(args[0], "."), args[0]+viewFlag(view))
 			}
 			return nil
 		},
@@ -87,8 +87,8 @@ DS after that.`,
 parent zone still has its DS record:
 
 1. The first run switches the zone to BIND's insecure policy. named keeps it
-   signed and publishes a CDS "delete" record. Remove the DS record at your
-   registrar, then run 'jarl zone dnssec check-ds' so named knows. named
+   signed and publishes a CDS "delete" record. Remove the DS record at the
+   parent ('status' says where), then run 'jarl zone dnssec check-ds' so named knows. named
    waits until resolvers have forgotten the DS (the parent's DS TTL, often a
    day) and then removes the keys and signatures.
 2. Run it again when 'status' says turning off has finished: DNSSEC is then
@@ -137,7 +137,7 @@ A zone whose DS never reached the parent can be wiped at once instead
 			if next == "insecure" && st.ParentZone != "" {
 				fmt.Printf("\nNext: remove the DS record for %s from %s:\n  %s\nthen run\n  jarl zone dnssec check-ds %s\nRun 'jarl zone dnssec disable %s' again when 'status' says it has finished.\n", displayName(st.Zone), displayName(st.ParentZone), parentDSCommand(st, "delete", ""), args[0]+viewFlag(view), args[0]+viewFlag(view))
 			} else if next == "insecure" {
-				fmt.Printf("\nNext: remove the DS record for %s at your registrar, then run\n  jarl zone dnssec check-ds %s\nRun 'jarl zone dnssec disable %s' again when 'status' says it has finished.\n", displayName(st.Zone), args[0]+viewFlag(view), args[0]+viewFlag(view))
+				fmt.Printf("\nNext: remove the DS record for %s %s, then run\n  jarl zone dnssec check-ds %s\nRun 'jarl zone dnssec disable %s' again when 'status' says it has finished.\n", displayName(st.Zone), dsPlace(st), args[0]+viewFlag(view), args[0]+viewFlag(view))
 			} else {
 				fmt.Println("\nDNSSEC is off. The old keys stay in the key directory until you wipe them ('jarl zone dnssec wipe').")
 			}
@@ -153,7 +153,7 @@ A zone whose DS never reached the parent can be wiped at once instead
 		Short: "Check the parent zone's DS records and tell named",
 		Long: `Asks every server of the parent zone for the zone's DS records, and tells
 named (rndc dnssec -checkds) when its key's DS has appeared there (after you
-added it at the registrar) or is gone (while turning DNSSEC off). named
+added it there) or is gone (while turning DNSSEC off). named
 moves to the next step only once it knows.
 
 The parent is found through jarld's resolver, or --resolver. Exits with 2
@@ -345,9 +345,12 @@ func printDNSSEC(w io.Writer, r *api.DNSSECResponse) {
 		}
 	}
 	if len(ds) > 0 && r.Policy != "insecure" {
-		where := "at your registrar"
+		if r.DSAt == "none" {
+			fmt.Fprintf(w, "\n%s\n", r.DSNote)
+		}
+		where := dsPlace(r)
 		if r.ParentZone != "" {
-			where = "in the parent zone " + displayName(r.ParentZone) + ", which is in Jarl: add it as a DS record there"
+			where += ", which is in Jarl: add it as a DS record there"
 		}
 		fmt.Fprintf(w, "\nDS record for the parent zone (%s):\n", where)
 		if !r.Phase.CanPublishDS && r.Phase.DSReadyAt != nil {
@@ -368,6 +371,14 @@ func printDNSSEC(w io.Writer, r *api.DNSSECResponse) {
 	}
 }
 
+// dsPlace says where the zone's DS record goes ("at your registrar").
+func dsPlace(r *api.DNSSECResponse) string {
+	if r.DSPlace != "" {
+		return r.DSPlace
+	}
+	return "at the parent zone"
+}
+
 // parentDSCommand is the jarl command that adds (or deletes) the zone's DS
 // record in its parent zone in Jarl.
 func parentDSCommand(r *api.DNSSECResponse, verb, data string) string {