Summary

We offer both internal and external DNS zones. The internal zones are used by anyone that is connected to the NURDspace lan or via VPN. The external zones are for internet to use.

Available zones

The following zones are available for editing.

Internal

nurdspace.nl
nurd.space
vm.nurd.space
lan.nurd.space
vpn.nurd.space

External

nurdspace.nl
nurd.space

Architecture

Internal DNS

Zones are managed using FreeIPA (https://ipa.nurd.space).
The two services machines (services-[12].lan.nurd.space) are configured to slave all zones that live on FreeIPA.
Dynamic DNS is provided using a script that parses the DHCP leases file and updates the corresponding zonefiles.
All records are exported in hosts file format on https://dns.lan.nurd.space/hosts.txt.

External DNS

Zones are managed and hosted using NSD on extdns.vm.nurd.space
Two externally hosted nameservers are configured as secondaries

secondary services.as65342.net

ipv4: 213.154.229.26
ipv6: 2001:7b8:3:47:213:154:229:26
hoster: BIT
operator: r3boot

secondary neutralino.soleus.nu

ipv4: 94.142.246.90
ipv6: 2a02:898:62:f6::5a
hoster: Soleus
operator: bofh team

Management

internal zones

Go to https://ipa.nurd.space/ and manage your dns entries.

external zones

The zonefiles can be found under /etc/nsd/zones. Navigate to that directory, and make the changes you need to make. Dont forget to update the serial number ;)

cd /etc/nsd/zones
vi db.nurd.space

Once the zone is updated, you need to sign it with the correct DNSSEC keys, and reload it. To make this easier, you can run the following command:

reload_zone.sh nurd.space

This script will perform the following steps (for nurd.space) if you are inclined to do this by hand:

cd /etc/nsd/zones
nsd-checkzone nurd.space db.nurd.space
ldns-signzone -n -s $(head -n 1000 /dev/random | sha256sum | cut -b 1-16) db.nurd.space $(cat nurd.space.zsk) $(cat nurd.space.ksk)
nsd-control reload nurd.space

Note that you need to wait atleast the zone TTL before you use external validation tools for the DNSSEC status (like https://dnsviz.net/), since these validation tools will cache DNSSEC records as long as they are queried.

DNSSEC

Setup DNSSEC for a domain

Start off by generating a zone signing key (ZSK) and a key signing key (KSK).

cd /etc/nsd/zones
ldns-keygen -a ECDSAP256SHA256 -b 1024 nurd.space > nurd.space.zsk
ldns-keygen -k -a ECDSAP256SHA256 -b 2048 nurd.space > nurd.space.ksk

Next, delete the automatically generated DS records, and sign the zone using the newly generated ZSK and KSK.

rm *.ds
ldns-signzone -n -s $(head -n 1000 /dev/random | sha256sum | cut -b 1-16) db.nurd.space `cat nurd.space.zsk` `cat nurd.space.ksk`

Finally, switch the zone config definition to the signed variant of the zonefile. Add .signed to the zone filename, as shown below:

zone:
  name: "nurd.space"
  zonefile: db.nurd.space.signed

Reload the zonefile using nsd-control:

nsd-control reconfig
nsd-control reload nurd.space

Once this is done, dnssec is enabled for the domain. Validate that this is working by checking the DNSKEY record(s) for the domain. You should get two records. One for the KSK, and one for the ZSK.

root@extdns:~# dig DNSKEY @10.208.1.33 nurd.space +multiline +norec +short
256 3 13 DsflOcaa2FufX6cYmH4A+LupEZqQwPGqAE/XTjghg9Kj+SgitAtizv8L rbE2KCJ/VhRZ7SEtptTjdrN9MwCrbg==
257 3 13 j6WGne+l0zp9QiX1lbeGRvYyAm3riQm49hbXeos2uJPh5xS2maAtBryk jfhIHUEYu3fHC1nIi/D2gutun711DQ==

To attach these keys to the DNSSEC chain of trust, you need to generate DS records for the domain, and submit these records to the DNS registrar. This will lead to the DS records being signed with the TLD keys, completing the chain of trust:

cd /etc/nsd/zones
ldns-key2ds -n -f -2 db.nurd.space.signed

This should return two DS records as can be seen below. Submit these records to the DNS registrar to get them included in the TLD zone.

nurd.space.	3600	IN	DS	12278 13 2 a9f5b7e06f85aea2679bc242a69950ec5fc8fd21f18833126b088b82c9cef2f6
nurd.space.	3600	IN	DS	35766 13 2 ce0766ad4857197d67e631c815ef13c654b6f601f15cbb54c6c43629127794a0

Once this process is completed, the zone is fully signed.

Zone cannot be resolved anymore

The signature of the nurd.space zone is configured with an expiry period. To fix this, the zone needs to be re-signed. Do this by updating the serial number in the zone, and run the following command:

/usr/local/sbin/reload_zone.sh nurd.space