Managing Mission - Critical Domains and DNS

PowerDNS

PowerDNS offers a flexible and easy DNSSEC implementation using the pdnsutil utility and can operate in a number of modes:

• live signing: This is the default. PowerDNS stores the zone records separately from any keys, it then calculates signatures on the fly as queries are received and the RRSIGs are heavily cached:

$ pdnsutil secure-zone example.com Securing zone with default key size
Adding CSK (257) with algorithm ecdsa256 Zone example.com secured
Adding NSEC ordering information

Notice that the setup defaulted to using a CSK.

We can also switch to using NSEC3 instead of NSEC fairly easily (contrast with BIND where we have to decide that we're going to use NSEC3 at the time we generate our keys):

$ pdnsutil set-nsec3 x9.to