DNS.Zone.DNSSEC (DNS v0.4.1)

DNSSEC zone signing and validation functionality.

Provides DNSSEC zone signing, key management, and record generation according to DNSSEC standards (RFC 4034, RFC 4035, RFC 4509).

Summary

Functions

calculate_key_tag(dnskey_record)

Calculate key tag for DNSKEY record.

generate_dnskey(zone_name, options \\ [])

Generate DNSKEY record for a DNSSEC zone.

generate_ds(zone_name, dnskey_record, options \\ [])

Generate DS record for a DNSKEY.

generate_key_pair(algorithm)

Generate key pair for DNSSEC.

generate_nsec3(owner_name, types, options \\ [])

Generate NSEC3 record for denial of existence with hashed names.

generate_nsec(owner_name, types, options \\ [])

Generate NSEC record for denial of existence.

generate_rrsig(zone_name, records, options \\ [])

Generate RRSIG record for a set of records.

sign_zone(zone, options \\ [])

Sign a complete zone with DNSSEC records.

validate_zone(zone)

Validate DNSSEC signatures for a zone.

Functions

calculate_key_tag(dnskey_record)

@spec calculate_key_tag(DNS.Message.Record.t()) :: integer()

Calculate key tag for DNSKEY record.

generate_dnskey(zone_name, options \\ [])

@spec generate_dnskey(
  String.t(),
  keyword()
) :: DNS.Message.Record.t()

Generate DNSKEY record for a DNSSEC zone.

generate_ds(zone_name, dnskey_record, options \\ [])

@spec generate_ds(String.t(), DNS.Message.Record.t(), keyword()) ::
  DNS.Message.Record.t()

Generate DS record for a DNSKEY.

generate_key_pair(algorithm)

@spec generate_key_pair(integer()) ::
  {:ok, %{public: binary(), private: binary()}} | {:error, String.t()}

Generate key pair for DNSSEC.

generate_nsec3(owner_name, types, options \\ [])

@spec generate_nsec3(String.t(), [atom()], keyword()) :: DNS.Message.Record.t()

Generate NSEC3 record for denial of existence with hashed names.

generate_nsec(owner_name, types, options \\ [])

@spec generate_nsec(String.t(), [atom()], keyword()) :: DNS.Message.Record.t()

Generate NSEC record for denial of existence.

generate_rrsig(zone_name, records, options \\ [])

@spec generate_rrsig(String.t(), [DNS.Message.Record.t()], keyword()) ::
  DNS.Message.Record.t()

Generate RRSIG record for a set of records.

sign_zone(zone, options \\ [])

@spec sign_zone(
  DNS.Zone.t(),
  keyword()
) :: {:ok, DNS.Zone.t()} | {:error, String.t()}

Sign a complete zone with DNSSEC records.

validate_zone(zone)

@spec validate_zone(DNS.Zone.t()) :: {:ok, boolean()} | {:error, String.t()}

Validate DNSSEC signatures for a zone.