hardware/nsd-dnssec

What is this?

Features

Build-time variables

Ports

Environment variables

Setup

$ORIGIN domain.tld.
$TTL 7200
; SOA
@ IN SOA ns1.domain.tld. hostmaster.domain.tld. (
 2016020202 ; Serial
 7200 ; Refresh
 1800 ; Retry
 1209600 ; Expire
 86400 ) ; Minimum
; NAMESERVERS
@ IN NS ns1.domain.tld.
@ IN NS ns2.domain.tld.
; A RECORDS
@ IN A IPv4
hostname IN A IPv4
ns1 IN A IPv4
ns2 IN A IPv4
; CNAME RECORDS
www IN CNAME hostname
; MAIL RECORDS
@ IN MX 10 hostname.domain.tld.
...

server:
 server-count: 1
 ip4-only: yes
 hide-version: yes
 identity: ""
 zonesdir: "/zones"
remote-control:
 control-enable: yes
key:
 name: "sec_key"
 algorithm: hmac-sha256
 secret: "WU9VUl9TRUNSRVRfS0VZCg==" # echo "YOUR_SECRET_KEY" | base64
zone:
 name: domain.tld
 zonefile: db.domain.tld.signed
 notify: ip_of_secondary_server sec_key
 notify: ip_of_secondary_public_server NOKEY
 provide-xfr: ip_of_secondary_server sec_key
 provide-xfr: ip_of_secondary_public_server NOKEY
# "ip_of_secondary_server" is your secondary nameserver IP
# "ip_of_secondary_public_server" can be your registrar's nameserver IP

server:
 server-count: 1
 ip4-only: yes
 hide-version: yes
 identity: ""
 zonesdir: "/zones"
remote-control:
 control-enable: yes
key:
 name: "sec_key"
 algorithm: hmac-sha256
 secret: "WU9VUl9TRUNSRVRfS0VZCg=="
zone:
 name: domain.tld
 zonefile: db.domain.tld.signed
 allow-notify: ip_of_primary_server sec_key
 request-xfr: AXFR ip_of_primary_server sec_key
# "ip_of_primary_server" is your primary nameserver IP

cd /mnt/docker/nsd
docker run --rm -v `pwd`/zones:/zones -ti hardware/nsd-dnssec nsd-checkzone domain.tld /zones/db.domain.tld
docker run --rm -v `pwd`/conf:/etc/nsd -ti hardware/nsd-dnssec nsd-checkconf /etc/nsd/nsd.conf

Docker-compose

Docker-compose.yml

nsd:
 image: hardware/nsd-dnssec
 container_name: nsd
 ports:
 - "PUBLIC_IP_ADDRESS:53:53"
 - "PUBLIC_IP_ADDRESS:53:53/udp"
 volumes:
 - /mnt/docker/nsd/conf:/etc/nsd
 - /mnt/docker/nsd/zones:/zones
 - /mnt/docker/nsd/db:/var/db/nsd

Run it

docker-compose up -d

Generating DNSSEC keys and signed zone

docker-compose exec nsd keygen domain.tld
Generating ZSK & KSK keys for 'domain.tld'
Done.

docker-compose exec nsd signzone domain.tld
Signing zone for domain.tld
NSD configuration rebuild... reconfig start, read /etc/nsd/nsd.conf
ok
Reloading zone for domain.tld... ok
Notify slave servers... ok
Done.
# or set custom RRSIG RR expiration date :
docker-compose exec nsd signzone domain.tld [YYYYMMDDhhmmss]
docker-compose exec nsd signzone domain.tld 20170205220210

#!/bin/bash
LETS_ENCRYPT_LIVE_PATH=/path/to/your/lets/encrypt/folder
fingerprint=$(openssl x509 -noout -in "${LETS_ENCRYPT_LIVE_PATH}/cert.pem" -fingerprint -sha256 | cut -c 20- | sed s/://g)
domain="domain.tld"
zonename="db.${domain}"
zonefile="/mnt/docker/nsd/zones/${zonename}"
serial=$(date -d "+1 day" +'%Y%m%d%H')
tlsa_line_number=$(grep -n TLSA $zonefile | cut -d : -f 1)
tlsa_dns_record="_dane IN TLSA 3 0 1 ${fingerprint}"
expiration_date=$(date -d "+6 months" +'%Y%m%d%H%M%S')
sed -i -e "s/20[0-9][0-9]\{7\} ; Serial/${serial} ; Serial/g" \
 -e "${tlsa_line_number}s/.*/${tlsa_dns_record}/" $zonefile
if docker exec nsd nsd-checkzone "$domain" /zones/"$zonename" | grep -q "zone ${domain} is ok"; then
 docker exec nsd signzone "$domain" "$expiration_date"
fi

docker-compose exec nsd ds-records domain.tld
> DS record 1 [Digest Type = SHA1] :
domain.tld. 600 IN DS xxxx 14 1 xxxxxxxxxxxxxx
> DS record 2 [Digest Type = SHA256] :
domain.tld. 600 IN DS xxxx 14 2 xxxxxxxxxxxxxx
> Public KSK Key :
domain.tld. IN DNSKEY 257 3 14 xxxxxxxxxxxxxx ; {id = xxxx (ksk), size = 384b}

docker-compose restart nsd