DNSSEC management

Tools provides first-class DNSSEC lifecycle management for DNS zones backed by the local/mounted BIND configuration.

The DNSSEC controls are available to administrators on the existing zone page under /admin/dns/zone/{zone}. External-provider zones are detected separately and cannot invoke the local BIND DNSSEC controls.

Control model

Tools uses BIND Key and Signing Policy (KASP) through dnssec-policy. Tools does not create, edit or remove DNSKEY, RRSIG or private key material itself.

The control path is deliberately limited to:

Read the zone block from the configured DNS_ZONES_PATH.
Add, replace or remove the zone's top-level dnssec-policy directive.
Validate the complete BIND configuration with named-checkconf.
Run the local rndc client to reconfigure BIND.
Roll the configuration file back if validation or reconfiguration fails.

There is no SSH fallback in the DNSSEC flow. The configuration directory may be local or mounted, but the BIND control command is always executed through the local rndc client.

Runtime configuration

The DNSSEC service reuses the existing Tools DNS environment contract:

DNS_MASTER_SERVER=
RNDC_PORT=953
DNS_EXTERNAL_RESOLVER=8.8.8.8,8.8.4.4,1.1.1.1
DNS_KEYS_PATH=
DNS_ZONES_PATH=

Tools validates the local /etc/named.conf configuration with the installed named-checkconf binary and uses the installed dig binary for DNSSEC observations. The authoritative BIND configuration therefore needs to be mounted consistently with the configured DNS_ZONES_PATH.

The initial enable policy is deliberately limited to BIND's default policy. The removal workflow uses BIND's special insecure policy internally. Parent DS transitions require two independent resolver confirmations when at least two resolver targets are configured.

Enable lifecycle

When DNSSEC is enabled, Tools:

applies an allowed dnssec-policy;
waits for BIND/KASP to publish a KSK/CSK DNSKEY;
derives registrar-ready DS records from the public authoritative DNSKEY RRset;
waits for enough independent recursive resolvers to observe the matching parent DS;
acknowledges the verified DS publication to BIND with rndc dnssec -checkds -key <tag> published <zone>;
waits for enough validating resolvers to return authenticated data before the zone is marked active.

The administrator page displays the DS values that need to be published at a registrar or parent when that step cannot be automated.

Disable lifecycle

DNSSEC removal is staged and fail-closed.

Tools first changes the zone to dnssec-policy insecure. It then waits until enough independent resolvers return a valid NOERROR response with no parent DS. Only after that observation does Tools acknowledge the withdrawal to BIND with rndc dnssec -checkds -key <tag> withdrawn <zone>.

Tools waits for BIND/KASP to finish removing DNSKEY/signature state before removing the final dnssec-policy directive. A resolver failure, SERVFAIL response, failed BIND acknowledgement, failed configuration validation or failed rndc reconfig cannot advance the removal.

Status and reconciliation

The scheduler runs php artisan dns:dnssec:reconcile every 15 minutes. A single zone can be checked manually with:

php artisan dns:dnssec:reconcile example.com

Scheduled checks update the stored lifecycle state and parent/validation snapshot. Opening the DNS admin page does not perform the full external resolver sweep, so the page remains responsive while showing the latest scheduled observations plus current local BIND/DNSKEY information.

Typical phases include:

policy_applied
signing
awaiting_parent_ds
validating
active_rollover_pending
active
awaiting_parent_ds_withdrawal
withdrawing_dnssec
disabled

Diagnostics and audit

Unexpected DNSSEC operational failures are reported through the always-on Tools operational diagnostics path to #toolsapi with safe service/action/result/zone/phase/correlation metadata.

Meaningful administrator actions, scheduled phase changes and failures are stored separately in dnssec_audit_logs. Audit context is allowlisted and does not persist credentials, tokens, private DNSSEC keys or raw command payloads.

Provider-backed zones

A zone routed through Cloudflare or another external provider mapping is shown as provider-managed. Local BIND DNSSEC mutation controls remain unavailable for that zone unless a future provider-specific implementation explicitly supports them.

Tornevall Networks