abrown38andClaude Opus 5.5
5630e7a848
Zones get a DNSSEC setting: named signs them with BIND's default (or a custom) dnssec-policy and inline signing, with keys in a per-view key directory. Jarl shows the keys, the DS record and when it is safe to publish it, checks the parent's DS records (check-ds, which also tells named), and refuses steps that would break a signed domain: switching straight to unsigned, finishing a turn-off too early, deleting or moving a signed zone, TTLs above max-zone-ttl. Turning off goes through the insecure policy; wipe starts over once the parent has no DS. Backups store the DNSSEC keys and restore puts them back for named; the backup unit gets CAP_DAC_READ_SEARCH to read them. Jarl raises a zone's serial above named's whenever it writes an older one (after a restore). The serials check compares the signed serial. With a Porkbun API key in jarl.yaml, the registrar's name servers, glue records and DS records can be shown and changed, each change checked first (dry run, force to override). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
24 lines
855 B
Plaintext
24 lines
855 B
Plaintext
; This is the state of key 642, for fast.test.
|
|
Algorithm: 13
|
|
Length: 256
|
|
Lifetime: 0
|
|
KSK: yes
|
|
ZSK: yes
|
|
Generated: 20261008203220 (Thu Oct 8 20:32:20 2026)
|
|
Published: 20261008203220 (Thu Oct 8 20:32:20 2026)
|
|
Active: 20261008203220 (Thu Oct 8 20:32:20 2026)
|
|
Retired: 20261008203319 (Thu Oct 8 20:33:19 2026)
|
|
Removed: 20261024213819 (Sat Oct 24 21:38:19 2026)
|
|
DSPublish: 20261008203249 (Thu Oct 8 20:32:49 2026)
|
|
DSRemoved: 20261008203329 (Thu Oct 8 20:33:29 2026)
|
|
PublishCDS: 20261008203234 (Thu Oct 8 20:32:34 2026)
|
|
DNSKEYChange: 20261008203234 (Thu Oct 8 20:32:34 2026)
|
|
ZRRSIGChange: 20261008203232 (Thu Oct 8 20:32:32 2026)
|
|
KRRSIGChange: 20261008203234 (Thu Oct 8 20:32:34 2026)
|
|
DSChange: 20261008203319 (Thu Oct 8 20:33:19 2026)
|
|
DNSKEYState: omnipresent
|
|
ZRRSIGState: omnipresent
|
|
KRRSIGState: omnipresent
|
|
DSState: unretentive
|
|
GoalState: hidden
|