Pdns: Feature suggestion: configuration option to publish CDS/CDNSKEY by default

[gryphius]

• Program: Authoritative
• Issue type: Feature request

Short description

I would like to suggest two new configuration settings default-publish-cds and default-publish-cdnskey which would instruct PowerDNS to automatically publish CDS / CDNSKEY records when a zone is being secured with DNSSEC.

Usecase

Right now, .cz is the only TLD which supports RFC8078/RFC7344 to automatically manage DS record in the parent, but other TLDs are starting to implement it (.ch and .li ) and hopefully more will follow. About 4% of DNSSEC signed domains in .CH currently are islands of security (no DS in parent), one of the reasons being poor or missing DNSSEC support at the registrar.
We're hoping to boost DNSSEC adoption with CDS.

For hosting companies which serve most domains in these ccTLDs this new setting would allow a atomic operation (secure-zone) to simultaneously sign a zone and automatically
update the chain of trust. Right now this requires two operations ( secure-zone + set-publish-cds ), combining them would make automation simpler and of course be a nice bragging opportunity ("protecting your domain with DNSSEC requires only one command!")

Description

The setting would work similar to current default-* settings. As soon as a zone is secured, for example through pdnsutil secure-zone , PowerDNS would check this setting and automatically
activate the PUBLISH-CDNSKEY or PUBLISH-CDS domain metadata if not empty.

The format could be the same as the allowed values for the domainmetadata:

• default-publish-cdnskey: boolean, default no
• default-publish-cds: comma separated list of digest algorithm numbers , default empty

Thanks for considering!

[Habbie]

This is good. If somebody types this in, we would merge it. If nobody types it in, we will, eventually.

[chris001]

I came here to open an issue for adding automatic DNSSEC thru RFC8078/RFC7344. @gryphius has opened this issue 2 days ago. I support this issue fully.

[Habbie]

PowerDNS would check this setting and automatically
activate the PUBLISH-CDNSKEY or PUBLISH-CDS domain metadata if not empty.

Instead of automatically setting it when securing the zone, I would prefer to fall back to the pdns.conf value if PUBLISH-* is not set.

[gryphius]

yes, that makes more sense and would probably also be more consistent with default values for other metadata.
Assuming I configure 'default-publish-cds=2,4' in pdns.conf I could still disable this for a specific zone by setting the empty string in the per zone metadata, right?
pdnsutil set-publish-cds idonotwantcds.example.com ""

[Habbie]

Exactly!

[mnordhoff]

What about additionally supporting "default-publish-cds=yes"? It would enable CDS using the default algorithm(s) used when you run "pdnsutil set-publish-cds example.com" without specifying any -- currently 2.

Probably not worth the complexity?

[Habbie]

Implemented in #8594. If anybody is going to test, please keep in mind domain-metadata-cache-ttl !

[gryphius]

Thanks @Habbie ! This is working like a charm. I made several manual tests with these new settings enabled and then overriding them with per-zone metadata (different algs for cds, empty string to disable, removing the metadata again etc) and everything produced the expected result.

pdns.conf

[...]
default-publish-cds=2,4
default-publish-cdnskey=1
domain-metadata-cache-ttl=1
````

pdnsutil create-zone totallysecure.example.com
pdnsutil secure-zone totallysecure.example.com
dig cds totallysecure.example.com @localhost -> returns cds 2,4 as expected
dig cdnskey totallysecure.example.com @localhost -> returns cdnskey as expected
pdnsutil set-meta totallysecure.example.com PUBLISH-CDNSKEY ""
dig cdnskey totallysecure.example.com @localhost -> NOERROR empty response as expected
pdnsutil set-meta totallysecure.example.com publish-cds 1
dig cds totallysecure.example.com @localhost -> returns cds 1 as expected

remove cds override again

pdnsutil set-meta totallysecure.example.com publish-cds
dig cds totallysecure.example.com @localhost -> returns cds 2,4 from the default again, as expected
````

[Habbie]

Yess