mirror of
https://github.com/coredns/coredns.git
synced 2025-10-31 00:01:35 +01:00
120 lines
3.3 KiB
Groff
120 lines
3.3 KiB
Groff
.\" Generated by Mmark Markdown Processer - mmark.miek.nl
|
|
.TH "COREDNS-DNSSEC" 7 "March 2021" "CoreDNS" "CoreDNS Plugins"
|
|
|
|
.SH "NAME"
|
|
.PP
|
|
\fIdnssec\fP - enables on-the-fly DNSSEC signing of served data.
|
|
|
|
.SH "DESCRIPTION"
|
|
.PP
|
|
With \fIdnssec\fP, any reply that doesn't (or can't) do DNSSEC will get signed on the fly. Authenticated
|
|
denial of existence is implemented with NSEC black lies. Using ECDSA as an algorithm is preferred as
|
|
this leads to smaller signatures (compared to RSA). NSEC3 is \fInot\fP supported.
|
|
|
|
.PP
|
|
This plugin can only be used once per Server Block.
|
|
|
|
.SH "SYNTAX"
|
|
.PP
|
|
.RS
|
|
|
|
.nf
|
|
dnssec [ZONES... ] {
|
|
key file KEY...
|
|
cache\_capacity CAPACITY
|
|
}
|
|
|
|
.fi
|
|
.RE
|
|
|
|
.PP
|
|
The signing behavior depends on the keys specified. If multiple keys are specified of which there is
|
|
at least one key with the SEP bit set and at least one key with the SEP bit unset, signing will happen
|
|
in split ZSK/KSK mode. DNSKEY records will be signed with all keys that have the SEP bit set. All other
|
|
records will be signed with all keys that do not have the SEP bit set.
|
|
|
|
.PP
|
|
In any other case, each specified key will be treated as a CSK (common signing key), forgoing the
|
|
ZSK/KSK split. All signing operations are done online.
|
|
Authenticated denial of existence is implemented with NSEC black lies. Using ECDSA as an algorithm
|
|
is preferred as this leads to smaller signatures (compared to RSA). NSEC3 is \fInot\fP supported.
|
|
|
|
.PP
|
|
If multiple \fIdnssec\fP plugins are specified in the same zone, the last one specified will be
|
|
used (See bugs
|
|
\[la]#bugs\[ra]).
|
|
|
|
.IP \(bu 4
|
|
\fBZONES\fP zones that should be signed. If empty, the zones from the configuration block
|
|
are used.
|
|
.IP \(bu 4
|
|
\fB\fCkey file\fR indicates that \fBKEY\fP file(s) should be read from disk. When multiple keys are specified, RRsets
|
|
will be signed with all keys. Generating a key can be done with \fB\fCdnssec-keygen\fR: \fB\fCdnssec-keygen -a
|
|
ECDSAP256SHA256 <zonename>\fR. A key created for zone \fIA\fP can be safely used for zone \fIB\fP. The name of the
|
|
key file can be specified in one of the following formats
|
|
|
|
.RS
|
|
.IP \(en 4
|
|
basename of the generated key \fB\fCKexample.org+013+45330\fR
|
|
.IP \(en 4
|
|
generated public key \fB\fCKexample.org+013+45330.key\fR
|
|
.IP \(en 4
|
|
generated private key \fB\fCKexample.org+013+45330.private\fR
|
|
|
|
.RE
|
|
.IP \(bu 4
|
|
\fB\fCcache_capacity\fR indicates the capacity of the cache. The dnssec plugin uses a cache to store
|
|
RRSIGs. The default for \fBCAPACITY\fP is 10000.
|
|
|
|
|
|
.SH "METRICS"
|
|
.PP
|
|
If monitoring is enabled (via the \fIprometheus\fP plugin) then the following metrics are exported:
|
|
|
|
.IP \(bu 4
|
|
\fB\fCcoredns_dnssec_cache_entries{server, type}\fR - total elements in the cache, type is "signature".
|
|
.IP \(bu 4
|
|
\fB\fCcoredns_dnssec_cache_hits_total{server}\fR - Counter of cache hits.
|
|
.IP \(bu 4
|
|
\fB\fCcoredns_dnssec_cache_misses_total{server}\fR - Counter of cache misses.
|
|
|
|
|
|
.PP
|
|
The label \fB\fCserver\fR indicated the server handling the request, see the \fImetrics\fP plugin for details.
|
|
|
|
.SH "EXAMPLES"
|
|
.PP
|
|
Sign responses for \fB\fCexample.org\fR with the key "Kexample.org.+013+45330.key".
|
|
|
|
.PP
|
|
.RS
|
|
|
|
.nf
|
|
example.org {
|
|
dnssec {
|
|
key file Kexample.org.+013+45330
|
|
}
|
|
whoami
|
|
}
|
|
|
|
.fi
|
|
.RE
|
|
|
|
.PP
|
|
Sign responses for a kubernetes zone with the key "Kcluster.local+013+45129.key".
|
|
|
|
.PP
|
|
.RS
|
|
|
|
.nf
|
|
cluster.local {
|
|
kubernetes
|
|
dnssec {
|
|
key file Kcluster.local+013+45129
|
|
}
|
|
}
|
|
|
|
.fi
|
|
.RE
|
|
|