NAME¶

dnssec-cds - change DS records for a child zone based on CDS/CDNSKEY

SYNOPSIS¶

dnssec-cds [-a alg...] [-c class] [-D] {-d dsset-file} {-f child-file} [-i [extension]] [-s start-time] [-T ttl] [-u] [-v level] [-V] {domain}

DESCRIPTION¶

The dnssec-cds command changes DS records at a delegation point based on CDS or CDNSKEY records published in the child zone. If both CDS and CDNSKEY records are present in the child zone, the CDS is preferred. This enables a child zone to inform its parent of upcoming changes to its key-signing keys; by polling periodically with dnssec-cds, the parent can keep the DS records up to date and enable automatic rolling of KSKs.

Two input files are required. The -f child-file option specifies a file containing the child's CDS and/or CDNSKEY records, plus RRSIG and DNSKEY records so that they can be authenticated. The -d path option specifies the location of a file containing the current DS records. For example, this could be a dsset- file generated by dnssec-signzone, or the output of dnssec-dsfromkey, or the output of a previous run of dnssec-cds.

The dnssec-cds command uses special DNSSEC validation logic specified by RFC 7344. It requires that the CDS and/or CDNSKEY records are validly signed by a key represented in the existing DS records. This will typically be the pre-existing key-signing key (KSK).

For protection against replay attacks, the signatures on the child records must not be older than they were on a previous run of dnssec-cds. This time is obtained from the modification time of the dsset- file, or from the -s option.

To protect against breaking the delegation, dnssec-cds ensures that the DNSKEY RRset can be verified by every key algorithm in the new DS RRset, and that the same set of keys are covered by every DS digest type.

By default, replacement DS records are written to the standard output; with the -i option the input file is overwritten in place. The replacement DS records will be the same as the existing records when no change is required. The output can be empty if the CDS / CDNSKEY records specify that the child zone wants to go insecure.

Warning: Be careful not to delete the DS records when dnssec-cds fails!

Alternatively, dnssec-cds -u writes an nsupdate script to the standard output. You can use the -u and -i options together to maintain a dsset- file as well as emit an nsupdate script.

OPTIONS¶

-a algorithm

-c class

-D

-d path

-f child-file

-i [extension]

-s start-time

-T ttl

-u

-V

-v level

domain

EXIT STATUS¶

The dnssec-cds command exits 0 on success, or non-zero if an error occurred.

In the success case, the DS records might or might not need to be changed.

EXAMPLES¶

Before running dnssec-signzone, you can ensure that the delegations are up-to-date by running dnssec-cds on every dsset- file.

To fetch the child records required by dnssec-cds you can invoke dig as in the script below. It's okay if the dig fails since dnssec-cds performs all the necessary checking.

for f in dsset-*
do
	d=${f#dsset-}
	dig +dnssec +noall +answer $d DNSKEY $d CDNSKEY $d CDS |
	dnssec-cds -i -f /dev/stdin -d $f $d
done

When the parent zone is automatically signed by named, you can use dnssec-cds with nsupdate to maintain a delegation as follows. The dsset- file allows the script to avoid having to fetch and validate the parent DS records, and it keeps the replay attack protection time.

dig +dnssec +noall +answer $d DNSKEY $d CDNSKEY $d CDS |
dnssec-cds -u -i -f /dev/stdin -d $f $d |
nsupdate -l

SEE ALSO¶

dig(1), dnssec-settime(8), dnssec-signzone(8), nsupdate(1), BIND 9 Administrator Reference Manual, RFC 7344.

AUTHORS¶

Internet Systems Consortium, Inc.

Tony Finch <dot@dotat.at>, <fanf2@cam.ac.uk>

COPYRIGHT¶

Copyright © 2017-2020 Internet Systems Consortium, Inc. ("ISC")