opendnssec(7)

💖 opendnssec(7) — the OpenDNSSEC overview, bestie edition 💖

okay so welcome to opendnssec(7), the big-picture page for OpenDNSSEC — literally making DNSSEC easy for DNS admins, no cap. this is your group-chat rundown before you dive into the individual tools. let's go 💅

---

✨ NAME ✨

OpenDNSSEC — making DNSSEC easy for DNS administrators. that's the whole vibe. 🦋

---

✨ SYNOPSIS ✨

ods-control start | stop

ods-enforcer subcommand...

ods-signer [subcommand...]

---

✨ DESCRIPTION ✨

OpenDNSSEC is a complete DNSSEC zone signing system that keeps your signed domains stable and secure. here's the tea: DNSSEC drags a whole lot of cryptographic drama into DNS, and OpenDNSSEC automates all of it so that regular DNS admins (yes, even you) can adopt DNSSEC without losing their minds. 🫶

So how does the signing actually happen? You slot OpenDNSSEC in between the place where the zone files get edited and the place where they get published. This version supports files and AXFR to move the zone data around. so basically OpenDNSSEC is acting as a "bump in the wire" between editing and publishing a zone. iconic behavior honestly ✨

OpenDNSSEC has two daemons, and they get started and stopped together through the ods-control(8) command. those daemons then go and invoke other programs to get their work done. very "I delegate" of them 👑

• One daemon is the KASP Enforcer, which enforces the policies defining security and timing requirements for each individual zone. Operators tend to interact with the KASP Enforcer a lot, through the ods-enforcer(8) command.
• The other daemon is the Signer Engine, which is the one that actually signs the zone content. It grabs that content from a file or over AXFR, and it publishes a signed version of the zone into a file or over AXFR. Direct interaction with the Signer Engine isn't normally necessary, but it is possible through the ods-signer(8) command.

Now, the keys that sign the zones live in an independent repository, accessed over a PKCS #11 interface. the whole point of that interface is to unleash access to cryptographic hardware — but there are implementations in software too. implementations range from open to commercial, and from very simple to highly secure. by default, OpenDNSSEC is configured to run on top of a SoftHSM, but there are a few other commands you can use to test any Hardware Security Module that might be sitting under the PKCS #11 API. 🔐

---

✨ OPERATIONAL PRACTICES ✨

OpenDNSSEC follows the best current practice of using two kinds of key per zone. let's meet them 🎀

🌸 KSK or Key Signing Key

This key belongs in the apex of a zone, and it's referenced in the parent zone (quite possibly a registry) in the form of DS records alongside NS records. Those parent references function as trust delegations.

The KSK is usually a longer key, and it could harm the efficiency of secure resolvers if every single individual resource record were signed with it. which is exactly why it's advisable to use the KSK only to sign the ZSK. 💡

In DNS records, you can usually recognise the KSK because it has its SEP (Secure Entry Point) flag set.

🌸 ZSK or Zone Signing Key

This key also belongs in the apex of a zone, and it's the one actually used to sign the resource records in a zone. It's a shorter key for efficiency reasons, and it gets rolled over on a fairly regular basis.

To detach those rollovers from the parent, the ZSK is not directly trusted by the parent zone — instead its trust is established by way of a signature by the KSK on the ZSK. teamwork, fr fr 🤝

---

OpenDNSSEC is super mindful about the period of validity of each key, and it will roll over in time to keep the domain signed with new keys, with no downtime for the secure domain. slay.

but here's the one thing that is not standardised, and therefore cannot be automated at the moment: the interface between a zone and its parent. so that part has to be done manually, or scripted around OpenDNSSEC. no getting around it bestie 😭

---

✨ SEE ALSO ✨

• ods-control(8)
• ods-enforcerd(8)
• ods-enforcer(8)
• ods-hsmspeed(1)
• ods-hsmutil(1)
• ods-kaspcheck(1)
• ods-kasp(5)
• ods-signer(8)
• ods-signerd(8)
• ods-timing(5)
• http://www.opendnssec.org/

---

✨ AUTHORS ✨

OpenDNSSEC was made by the OpenDNSSEC project — you can find them over at http://www.opendnssec.org/. 💜

---

and that's the whole page, bestie!! this one's from the OpenDNSSEC crew, dated February 2010 — yes, it's been serving DNSSEC realness since way back. go forth and sign some zones 👑💖✨