javascript - How can I check DNSSEC compliance with nodejs? -
i'm building web analytics tools, i'm having difficulty checking dnssec compliance in nodejs application. none of dnssec record types seem accepted dns
module in standard library. i'm attempting rrsig
, ds
, nsec
, nsec3
docs not list them valid rrtypes resolve. possible nodejs?
unless you're planning on implementing dnssec validation in javascript (good luck that!) you're going dependent on external validator indicate valid, invalid, or insecure (dnssec not configured). largest dnssec validator in world in google public dns (better known 8.8.8.8), , conveniently have added https-based api should pretty easy use node.js code (the api responses json).
you can check successful resolution , without &cd=1 parameter disable dnssec validation:
- servfail ("status": 2) both queries bad delegation
- servfail without &cd=1 invalid dnssec configuration
- success ("status": 0) no authenticated data ("ad": false) non-dnssec zone
- success authenticated data ("ad": true) valid dnssec configuration
the downside these remote web api calls, local validating resolver depending on remote dns queries, there's not difference (except caching).
if want generate diagnostics specific problems invalid dnssec configurations, you'll need query dnssec-specific record types directly (this works ds, dnskey, nsec, nsec3, nsec3param, , rrsig - have generate nsec3 hash name using nsec3param data yourself, painful)
Comments
Post a Comment