Personal tools

From HEXONET Wiki

Jump to: navigation, search
(Examples)
 
(7 intermediate revisions by 3 users not shown)
Line 1: Line 1:
{{Sidebar}}
+
{{Sidebar}}__NOTOC__
__NOTOC__
+
 
+
 
== DNSSEC (SecureDNS) ==
 
== DNSSEC (SecureDNS) ==
  
Line 10: Line 8:
  
  
We made sure to create our API in a way to be compatible with all current and future DNSSEC enabled registry systems.
+
We made sure to create our API to be compatible with all current and future DNSSEC enabled registry systems.
 
Similar to the handling of contacts and nameservers, two (2) different ways exist for a registry to manage DNSSEC data for delegations:
 
Similar to the handling of contacts and nameservers, two (2) different ways exist for a registry to manage DNSSEC data for delegations:
  
Line 19: Line 17:
  
 
The HEXONET API supports both types.
 
The HEXONET API supports both types.
Further, beyond just the required type, we have set up our system to also accept both DS and KEY data simultaneously for any TLD, so that anyone wishing to can simply submit both instead of having to determine which one is required for each TLD.   
+
Further, beyond just the required type, we have set up our system to also accept both DS and KEY data simultaneously for any TLD, so that anyone can simply submit both instead of having to determine which one is required for each TLD.   
  
  
Line 28: Line 26:
 
== Supported TLDs ==
 
== Supported TLDs ==
  
Currently we support DNSSEC for five (5) TLDs in production:
+
If DNSSEC is supported for HEXONET TLD´s, please see the respective SEC DNS column in the domain-detail view.
 
+
 
+
* '''.COM''': DS interface
+
* '''.NET''': DS interface
+
* '''.ORG''': DS interface, max 10 secDNS records
+
* '''.DE''': KEY interface, max 5 secDNS records
+
* '''.EU''': KEY interface, max 4 secDNS records
+
* '''.SE''': DS interface, max 6 secDNS records
+
* '''.UK''': DS interface, max 8 secDNS records
+
 
+
 
+
More DNSSEC enabled TLDs will surely follow soon!
+
  
  
 
== General parameters ==
 
== General parameters ==
  
'''secDNS-remove-all = 0 | 1 (ModifyDomain)'''
+
<pre>secDNS-remove-all = 0 | 1 (ModifyDomain)</pre>
  
 
This parameter is used to remove all DNSSEC records (DS and key data), if set to 1. A value of 0 will do nothing.
 
This parameter is used to remove all DNSSEC records (DS and key data), if set to 1. A value of 0 will do nothing.
  
  
'''secDNS-maxSigLife = <INT> (AddDomain/ModifyDomain)'''
+
<pre>secDNS-maxSigLife = <INT> (AddDomain/ModifyDomain)</pre>
  
 
An OPTIONAL parameter setting the preference for the number of seconds after signature generation. When the parent's signature on the DS information provided by the child will expire. There is ONLY ONE maxSigLife per domain. The use of this parameter depends on the registry operator, many TLDs will silently ignore it.
 
An OPTIONAL parameter setting the preference for the number of seconds after signature generation. When the parent's signature on the DS information provided by the child will expire. There is ONLY ONE maxSigLife per domain. The use of this parameter depends on the registry operator, many TLDs will silently ignore it.
  
  
'''secDNS-urgent = 0 | 1 (ModifyDomain)'''
+
<pre>secDNS-urgent = 0 | 1 (ModifyDomain)</pre>
  
 
This parameter is used to ask the server operator to complete and implement the update request with high priority. The use of this flag depends on the registry operator, many TLDs will silently ignore it.
 
This parameter is used to ask the server operator to complete and implement the update request with high priority. The use of this flag depends on the registry operator, many TLDs will silently ignore it.
 
  
 
== DS Data Interface ==
 
== DS Data Interface ==
  
* '''secDNS-ds# = <keyTag> <alg> <digestType> <digest>  (AddDomain/ModifyDomain)'''
+
<pre>secDNS-ds# = <keyTag> <alg> <digestType> <digest>  (AddDomain/ModifyDomain)</pre>
* '''addsecDNS-ds# = <keyTag> <alg> <digestType> <digest>  (ModifyDomain)'''
+
<pre>addsecDNS-ds# = <keyTag> <alg> <digestType> <digest>  (ModifyDomain)</pre>
* '''delsecDNS-ds# = <keyTag> <alg> <digestType> <digest>  (ModifyDomain)'''
+
<pre>delsecDNS-ds# = <keyTag> <alg> <digestType> <digest>  (ModifyDomain)</pre>
  
 
The order of these whitespace-separated parameters matches the DNS DS record type.
 
The order of these whitespace-separated parameters matches the DNS DS record type.
  
  
'''secDNS-ds keyTag = <INT>'''
+
<pre>secDNS-ds keyTag = <INT></pre>
  
 
A parameter that contains a key tag value as described in Section 5.1.1 of RFC 4034.
 
A parameter that contains a key tag value as described in Section 5.1.1 of RFC 4034.
Line 75: Line 60:
  
  
'''secDNS-ds alg = <INT>'''
+
<pre>secDNS-ds alg = <INT></pre>
  
 
A parameter that contains an algorithm value as described in Section 5.1.2 of RFC 4034.
 
A parameter that contains an algorithm value as described in Section 5.1.2 of RFC 4034.
  
  
'''secDNS-ds digestType = <INT>'''
+
<pre>secDNS-ds digestType = <INT></pre>
  
 
A parameter that contains a digest type value as described in Section 5.1.3 of RFC 4034.
 
A parameter that contains a digest type value as described in Section 5.1.3 of RFC 4034.
  
  
'''secDNS-ds digest = <TEXT>'''
+
<pre>secDNS-ds digest = <TEXT></pre>
  
 
A parameter that contains a digest value as described in Section 5.1.4 of RFC 4034.  
 
A parameter that contains a digest value as described in Section 5.1.4 of RFC 4034.  
 
The parameter is represented as a hexBinary [W3C.REC-xmlschema-2-20010502].
 
The parameter is represented as a hexBinary [W3C.REC-xmlschema-2-20010502].
 
  
 
== Key Data Interface ==
 
== Key Data Interface ==
Line 95: Line 79:
 
Key data may be provided OPTIONALLY when using the DS Data Interface, using these parameters:
 
Key data may be provided OPTIONALLY when using the DS Data Interface, using these parameters:
  
* '''secDNS-key# = <flags> <protocol> <alg> <pubKey>  (AddDomain/ModifyDomain)'''
+
<pre>secDNS-key# = <flags> <protocol> <alg> <pubKey>  (AddDomain/ModifyDomain)</pre>
* '''addsecDNS-key# = <flags> <protocol> <alg> <pubKey>  (ModifyDomain)'''
+
<pre>addsecDNS-key# = <flags> <protocol> <alg> <pubKey>  (ModifyDomain)</pre>
* '''delsecDNS-key# = <flags> <protocol> <alg> <pubKey>  (ModifyDomain)'''
+
<pre>delsecDNS-key# = <flags> <protocol> <alg> <pubKey>  (ModifyDomain)</pre>
  
 
The order of these whitespace-separated parameters matches the DNS DNSKEY record type.
 
The order of these whitespace-separated parameters matches the DNS DNSKEY record type.
  
  
'''secDNS-key flags = <INT>'''
+
<pre>secDNS-key flags = <INT></pre>
  
 
A parameter that contains a flags field value as described in Section 2.1.1 of RFC 4034.
 
A parameter that contains a flags field value as described in Section 2.1.1 of RFC 4034.
  
  
'''secDNS-key protocol = <INT>'''
+
<pre>secDNS-key protocol = <INT></pre>
  
 
A parameter that contains a protocol field value as described in Section 2.1.2 of RFC 4034.
 
A parameter that contains a protocol field value as described in Section 2.1.2 of RFC 4034.
  
  
'''secDNS-key alg = <INT>'''
+
<pre>secDNS-key alg = <INT></pre>
  
 
A parameter that contains an algorithm number field value as described in Section 2.1.3 of RFC 4034.
 
A parameter that contains an algorithm number field value as described in Section 2.1.3 of RFC 4034.
  
  
'''secdns-key pubKey = <TEXT>'''
+
<pre>secdns-key pubKey = <TEXT></pre>
  
 
A parameter that contains an encoded public key field value as described in Section 2.1.4 of RFC 4034.
 
A parameter that contains an encoded public key field value as described in Section 2.1.4 of RFC 4034.
 
The parameter is represented as a base64Binary [W3C.REC-xmlschema-2-20010502] with a minimum length of 1.
 
The parameter is represented as a base64Binary [W3C.REC-xmlschema-2-20010502] with a minimum length of 1.
 
  
 
== Examples ==
 
== Examples ==
Line 128: Line 111:
  
 
  domain = org-domain.org
 
  domain = org-domain.org
secDNS-urgent = 1
 
 
  secDNS-ds0 = 27919 5 1 C9FB4F34C8C73B10B8F41D87381B1FDD8D1EE9F0
 
  secDNS-ds0 = 27919 5 1 C9FB4F34C8C73B10B8F41D87381B1FDD8D1EE9F0
  

Latest revision as of 08:35, 23 March 2017

[edit] DNSSEC (SecureDNS)

The DNSSEC extension to our API covers three (3) API commands:


We made sure to create our API to be compatible with all current and future DNSSEC enabled registry systems. Similar to the handling of contacts and nameservers, two (2) different ways exist for a registry to manage DNSSEC data for delegations:


  • DS based (e.g. .ORG)
  • DNSKEY based (e.g. .de).


The HEXONET API supports both types. Further, beyond just the required type, we have set up our system to also accept both DS and KEY data simultaneously for any TLD, so that anyone can simply submit both instead of having to determine which one is required for each TLD.


So you decide yourself if you implement the minimum requirement on a "per TLD" basis, or if you always provide DS and KEY data. Please be advised that our nameserver cluster doesn't support DNSSEC yet, so you will need to setup your own DNSSEC enabled nameservers for now.


[edit] Supported TLDs

If DNSSEC is supported for HEXONET TLD´s, please see the respective SEC DNS column in the domain-detail view.


[edit] General parameters

secDNS-remove-all = 0 | 1 (ModifyDomain)

This parameter is used to remove all DNSSEC records (DS and key data), if set to 1. A value of 0 will do nothing.


secDNS-maxSigLife = <INT> (AddDomain/ModifyDomain)

An OPTIONAL parameter setting the preference for the number of seconds after signature generation. When the parent's signature on the DS information provided by the child will expire. There is ONLY ONE maxSigLife per domain. The use of this parameter depends on the registry operator, many TLDs will silently ignore it.


secDNS-urgent = 0 | 1 (ModifyDomain)

This parameter is used to ask the server operator to complete and implement the update request with high priority. The use of this flag depends on the registry operator, many TLDs will silently ignore it.

[edit] DS Data Interface

secDNS-ds# = <keyTag> <alg> <digestType> <digest>  (AddDomain/ModifyDomain)
addsecDNS-ds# = <keyTag> <alg> <digestType> <digest>  (ModifyDomain)
delsecDNS-ds# = <keyTag> <alg> <digestType> <digest>  (ModifyDomain)

The order of these whitespace-separated parameters matches the DNS DS record type.


secDNS-ds keyTag = <INT>

A parameter that contains a key tag value as described in Section 5.1.1 of RFC 4034. The parameter is represented as an unsignedShort [W3C.REC-xmlschema-2-20010502].


secDNS-ds alg = <INT>

A parameter that contains an algorithm value as described in Section 5.1.2 of RFC 4034.


secDNS-ds digestType = <INT>

A parameter that contains a digest type value as described in Section 5.1.3 of RFC 4034.


secDNS-ds digest = <TEXT>

A parameter that contains a digest value as described in Section 5.1.4 of RFC 4034. The parameter is represented as a hexBinary [W3C.REC-xmlschema-2-20010502].

[edit] Key Data Interface

Key data may be provided OPTIONALLY when using the DS Data Interface, using these parameters:

secDNS-key# = <flags> <protocol> <alg> <pubKey>  (AddDomain/ModifyDomain)
addsecDNS-key# = <flags> <protocol> <alg> <pubKey>  (ModifyDomain)
delsecDNS-key# = <flags> <protocol> <alg> <pubKey>  (ModifyDomain)

The order of these whitespace-separated parameters matches the DNS DNSKEY record type.


secDNS-key flags = <INT>

A parameter that contains a flags field value as described in Section 2.1.1 of RFC 4034.


secDNS-key protocol = <INT>

A parameter that contains a protocol field value as described in Section 2.1.2 of RFC 4034.


secDNS-key alg = <INT>

A parameter that contains an algorithm number field value as described in Section 2.1.3 of RFC 4034.


secdns-key pubKey = <TEXT>

A parameter that contains an encoded public key field value as described in Section 2.1.4 of RFC 4034. The parameter is represented as a base64Binary [W3C.REC-xmlschema-2-20010502] with a minimum length of 1.

[edit] Examples

AddDomain/ModifyDomain parameters for DS data:

domain = org-domain.org
secDNS-ds0 = 27919 5 1 C9FB4F34C8C73B10B8F41D87381B1FDD8D1EE9F0


AddDomain/ModifyDomain parameters for key data:

domain = de-domain.de
secDNS-maxSigLife = 604800
secDNS-key0 = 257 3 5 AwEAAcXwGatVRLkzRgV/sFSr0h4n+u/OVDuWI7bkAgXeEc3i/dSBfcG7/k5OvhYKCq+eQYbTP/kHsQUOzQPW2dDNSgFfQYOqN4ItAbxEhc7e5b79tVThCp5vxRT1iDp57bPlB0M2vfGr3d2TwNZUmUP4RQqyycJm2KXXYpI81aY+DCzh


StatusDomain properties for DS data only:

PROPERTY[SECDNS-MAXSIGLIFE][0]=604800
PROPERTY[SECDNS-DS][0]=27919 5 1 C9FB4F34C8C73B10B8F41D87381B1FDD8D1EE9F0
PROPERTY[SECDNS-KEY][0]=


StatusDomain properties for key data only:

PROPERTY[SECDNS-MAXSIGLIFE][0]=604800
PROPERTY[SECDNS-DS][0]=
PROPERTY[SECDNS-KEY][0]=257 3 5 AwEAAcXwGatVRLkzRgV/sFSr0h4n+u/OVDuWI7bkAgXeEc3i/dSBfcG7/k5OvhYKCq+eQYbTP/kHsQUOzQPW2dDNSgFfQYOqN4ItAbxEhc7e5b79tVThCp5vxRT1iDp57bPlB0M2vfGr3d2TwNZUmUP4RQqyycJm2KXXYpI81aY+DCzh


StatusDomain properties for DS data with optional key data:

PROPERTY[SECDNS-MAXSIGLIFE][0]=604800
PROPERTY[SECDNS-DS][0]=27919 5 1 C9FB4F34C8C73B10B8F41D87381B1FDD8D1EE9F0
PROPERTY[SECDNS-KEY][0]=257 3 5 AwEAAcXwGatVRLkzRgV/sFSr0h4n+u/OVDuWI7bkAgXeEc3i/dSBfcG7/k5OvhYKCq+eQYbTP/kHsQUOzQPW2dDNSgFfQYOqN4ItAbxEhc7e5b79tVThCp5vxRT1iDp57bPlB0M2vfGr3d2TwNZUmUP4RQqyycJm2KXXYpI81aY+DCzh