StackExchange/dnscontrol
1
1
Fork 0
mirror of https://github.com/StackExchange/dnscontrol.git synced 2025-01-12 10:27:57 +08:00
Code Issues Projects Releases Packages Wiki Activity
dnscontrol/commands/test_data/example.org.zone

1151 lines
54 KiB
Dns
Raw Normal View History

get-zones output should work as input into preview (#688) * Add tests for get-zones * fix CAA, SSHFP, TLSA and other bugs * New format for get-zones: "djs" which is js but uses "disco commas" * Print diffs using github.com/andreyvit/diff Co-authored-by: Tom Limoncelli <tlimoncelli@stackoverflow.com>
2020-03-10 23:32:47 +08:00
; Copyright © 2006-2020 Phil Pennock
; No warranty: if it breaks, you get to cut your hands picking up the shards.
; Permission granted to duplicate in its entirety with authorship preserved,
; or redact as needed for test frameworks, or copy fragments for use in your
; own domains, or pretty much anything else except presenting it as your own
; creation.
$TTL 7200
$ORIGIN example.org.
; This is adapted from a real zonefile.
; All IPs and DNS should be using address-spaces reserved for documentation or
; otherwise available for this usage.
; The original had a /28 routed to an onlink /32 in IPv4, and a /48 for IPv6.
;
; A couple of entries come from a different zone, to round out the examples.
;
; Some information has been redacted, eg Let's Encrypt account numbers.
; Some public keys are the same as they were in the original zone-file, so if
; you have tooling which parses ASN structure or whatever, they should still be
; good.
; If you have a DNS Observatory, you can probably identify the original zone
; through some of these. Good luck!
;
; Some of the IPv6 stuff shows a H:EX encoding scheme; that's real, not
; invented for the example.org redaction. I just changed the prefix.
; {{{ SOA and NS records
example.org. 43200 SOA ns1.example.org. hostmaster.example.org. (
2020030700 ; serial
7200 ; refresh period
3600 ; retry interval
10d ; expire time
7200 ; default/negative TTL
)
NS ns1.example.org.
NS ns2.example.org.
NS ns-a.example.net.
NS friend-dns.example.com.
; }}} SOA and NS records
;;; ======================================================================
; EMAIL FEDERATION {{{
; These are not for clients within our domain.
; These are for sending and receiving email, and telling other mail-systems
; what can send email as us, or claim to be us in HELO, etc.
;
; For SPF: this affects "domains which aren't the domain in question"; we can
; ignore it for our own domains from systems under our control, as the
; mail-server we list here is the one which all mail is channeled through, so
; is what the outside world sees, so is the one listed.
MX 10 mx
TXT "v=spf1 ip4:192.0.2.25 ip6:2001:db8::1:25 mx include:_spf.example.com ~all"
; CSA Priority/Weight/Port;
; Priority for CSA version, so 1
; Weight: 1 unauthorized, 2 authorized, 3 unknown (bit-field)
; Port: assertions: 0 no assertion; 1 subdomains must use CSA
; Target: hostname for which sender IP must be in the RRsets of address records
; Top-level assertion: we list _all_ hostnames which send email out, so EHLO/HELO claiming to be us must be covered here.
; Because almost all mail routes through the mail-hub, we can make this claim; foo is exception
_client._smtp SRV 1 1 1 @
_client._smtp.mx SRV 1 2 1 mx
_client._smtp.foo SRV 1 2 1 foo
; }}}
;;; ======================================================================
; Authentication and directory services {{{
; _Service._Proto.Name TTL Class SRV Priority Weight Port Target
_kerberos._tcp SRV 10 1 88 kerb-service
_kerberos._udp SRV 10 1 88 kerb-service
_kpasswd._udp SRV 10 1 464 kerb-service
_kerberos-adm._tcp SRV 10 1 749 kerb-service
_kerberos TXT "EXAMPLE.ORG"
; No LDAP service, and tell people that.
_ldap._tcp SRV 0 0 0 .
_ldap._udp SRV 0 0 0 .
; PGP Universal & GnuPG use keys.$domain to find PGP keys, via LDAP
; }}}
;;; ======================================================================
; Chat services {{{
; XMPP we divide up the hostnames for federation vs client access.
; Federation on xmpp-s2s, client access on xmpp.
; They are the same host, but we architect to be able to split.
_jabber._tcp SRV 10 2 5269 xmpp-s2s
_xmpp-server._tcp SRV 10 2 5269 xmpp-s2s
_xmpp-client._tcp SRV 10 2 5222 xmpp
; I don't think we need _im._xmpp and _pres._xmpp for a real present server, so
; skip them. If setting up a domain without XMPP, publish `0 0 0 .` for these too.
; _im._xmpp SRV ...
; _pres._xmpp SRV ...
; RFC 3832 "Remote Discovery in SLP via DNS SRV" {exp}: _slpda.{_tcp,_udp}
; RFC 3861: _im.<proto> and _pres.<proto> for IM protocols;
; Instant Messaging SRV Protocol Label registry http://www.iana.org/assignments/im-srv-labels
; Presence SRV Protocol Label registry http://www.iana.org/assignments/pres-srv-labels/pres-srv-labels.xhtml
; So far, both only contain: _xmpp
; Thus _im._xmpp _pres._xmpp
; draft-loreto-simple-im-srv-label-02.txt adds _sip: _im._sip _pres._sip
; RFC 3921: _im._xmpp _pres._xmpp _xmpp._tcp
; SIP SRV: http://www.iana.org/assignments/sip-table
; _sip+d2t._tcp _sips+d2t._tcp _sip+d2u._udp _sip+d2s._sctp _sips+d2s._sctp
; RFC 4386: http://www.iana.org/assignments/pkix-parameters/pkix-parameters.xhtml
; _pkixrep.<proto> -> _ldap _http _ocsp
; Also possibly: _sip _sips _sipfederation _msrps
_im._sip SRV 0 0 0 .
_pres._sip SRV 0 0 0 .
_sip+d2t._tcp SRV 0 0 0 .
_sips+d2t._tcp SRV 0 0 0 .
_sip+d2u._udp SRV 0 0 0 .
_sip+d2s._sctp SRV 0 0 0 .
_sips+d2s._sctp SRV 0 0 0 .
; }}}
;;; ======================================================================
; Email service for use by clients within the domain. {{{
; RFC 6186 (was: draft-daboo-srv-email-05.txt)
; RFC 8314 updates for submissions
; RFC 8314 updates for submissions (obsoletes all cleartext)
; RFC 8552 sets up a registry for all the underscore services and 8553 backfills it
_submission._tcp SRV 10 10 587 smtp
_submissions._tcp SRV 10 10 465 smtp
_imap._tcp SRV 10 10 143 imap
_imaps._tcp SRV 10 10 993 imap
_pop3._tcp SRV 0 0 0 .
_pop3s._tcp SRV 0 0 0 .
_sieve._tcp SRV 10 10 4190 imap
; }}}
;;; ======================================================================
; Other zone-top services {{{
; Where can people send questions or get more information
;;;@ RP hostmaster.example.org. dns-moreinfo.example.org.
dns-moreinfo TXT (
"Fred Bloggs, TZ=America/New_York"
"Chat-Service-X: @handle1"
"Chat-Service-Y: federated-handle@example.org"
)
; SKS withdrawn
_pgpkey-http._tcp SRV 0 0 0 .
_pgpkey-https._tcp SRV 0 0 0 .
_hkp._tcp SRV 0 0 0 .
; WKD <https://datatracker.ietf.org/doc/draft-koch-openpgp-webkey-service/?include_text=1>
; The SRV record should be disappearing because it was removed from the spec.
; In the meantime, point it to the host while being cognizant that GnuPG will
; use the hostname from the target of the SRV for the Host header.
_openpgpkey._tcp SRV 10 10 443 openpgpkey.example.org.
; Not sure anything actually uses this, but ah well
; Avoid pointing at a CNAME, just use barbican directly
_finger._tcp SRV 10 10 79 barbican
; https://wiki.libravatar.org/api/
_avatars-sec._tcp SRV 10 10 443 avatars
; For bare domain as a hostname, we try to avoid it as much as possible.
; Sometimes, it's necessary, eg finger.
; Once it exists in DNS though, HTTP requests will try to hit it when people
; don't type `www.`
; So we point the bare domain at a minimal jail with "not much" in it, and
; use packet filters to redirect the traffic to the correct places.
; For HTTP, we'll issue redirects to avoid this. For finger, we just respond.
@ A 192.0.2.1
@ AAAA 2001:db8::1:1
; }}}
;;; ======================================================================
; Email cryptographic authentication {{{
; RFC5585 DomainKeys Identified Mail (DKIM) Service Overview
_adsp._domainkey TXT "dkim=all" ; RFC5617 unknown | all | discardable
; http://dmarc.org/draft-dmarc-base-00-01.html DMARC DKIM policy
;
; DMARC: beware that some validators require v/p with no intermediate values,
; which one reading of RFC7489 can support. So keep those together at the front.
_dmarc TXT "v=DMARC1; p=none; sp=none; rua=mailto:dmarc-notify@example.org; ruf=mailto:dmarc-notify@example.org; adkim=s"
; [This is a good place to have a link to documentation on local processes for
; updating DKIM keys]
;
; These are the real current (March 2020) values for the domain which this
; example was drawn from.
; Note that the domain dual-signs email with both RSA and Ed25519 keys.
; The domain also cycles DKIM keys every three months, but it's manual and the
; calendar reminder was missed in February. Oops.
;
d201911._domainkey TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4SmyE5Tz5/wPL8cb2AKuHnlFeLMOhAl1UX/NYaeDCKMWoBPTgZRT0jonKLmV2UscHdodXu5ZsLr/NAuLCp7HmPLReLz7kxKncP6ppveKxc1aq5SPTKeWe77p6BptlahHc35eiXsZRpTsEzrbEOainy1IWEd+w9p1gWbrSutwE22z0i4V88nQ9UBa1ks" "6cVGxXBZFovWC+i28aGs6Lc7cSfHG5+Mrg3ud5X4evYXTGFMPpunMcCsXrqmS5a+5gRSEMZhngha/cHjLwaJnWzKaywNWF5XOsCjL94QkS0joB7lnGOHMNSZBCcu542Y3Ht3SgHhlpkF9mIbIRfpzA9IoSQIDAQAB"
d201911e2._domainkey TXT "v=DKIM1; k=ed25519; p=GBt2k2L39KUb39fg5brOppXDHXvISy0+ECGgPld/bIo="
;
d202003._domainkey TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv/1tQvOEs7xtKNm7PbPgY4hQjwHVvqqkDb0+TeqZHYRSczQ3c0LFJrIDFiPIdwQe/7AuKrxvATSh/uXKZ3EP4ouMgROPZnUxVXENeetJj+pc3nfGwTKUBTTTth+SO74gdIWsntjvAfduzosC4ZkxbDwZ9c253qXARGvGu+LB/iAeq0ngEbm5fU13+Jo" "pv0d4dR6oGe9GvMEnGGLZzNrxWl1BPe2x5JZ5/X/3fW8vJx3OgRB5N6fqbAJ6HZ9kcbikDH4lPPl9RIoprFk7mmwno/nXLQYGhPobmqq8wLkDiXEkWtYa5lzujz3XI3Zkk8ZIOGvdbVVfAttT0IVPnYkOhQIDAQAB"
d202003e2._domainkey TXT "v=DKIM1; k=ed25519; p=DQI5d9sNMrr0SLDoAi071IFOyKnlbR29hAQdqVQecQg="
;
; http://tools.ietf.org/html/draft-ietf-marf-reporting-discovery-01
_report TXT "r=abuse-reports@example.org; rf=ARF; re=postmaster@example.org;"
; These are for RFC8460 and the sender needs to support MTA-STS or DANE; if
; they only support one, we might get error complaints.
; SMTP TLS Reporting used `_smtp-tlsrpt` in <https://tools.ietf.org/html/draft-ietf-uta-smtp-tlsrpt-17>
; but `_smtp._tls` by the time RFC 8460 was published.
_smtp._tls TXT "v=TLSRPTv1; rua=mailto:smtp-tls-reports@example.org"
_smtp-tlsrpt TXT "v=TLSRPTv1; rua=mailto:smtp-tls-reports@example.org"
; RFC 7489 § 7.1
; Any domains which point their DMARC records to email in this domain need
; to be authorized by having a record here, saying "yes, it's known, go ahead
; and send their DMARC reports to us."
;
; This is not needed for our sub-domains, because they're the same
; "organizational domain" as us (organizational domain is the thing which is
; publicly registered, ie where the parent domain is in the public suffix
; list).
;
$ORIGIN _report._dmarc.example.org.
example.net TXT "v=DMARC1"
example.com TXT "v=DMARC1"
xn--2j5b.xn--9t4b11yi5a TXT "v=DMARC1"
special.test TXT "v=DMARC1"
xn--qck5b9a5eml3bze.xn--zckzah TXT "v=DMARC1"
$ORIGIN example.org.
; https://datatracker.ietf.org/doc/draft-ietf-dane-smime/?include_text=1
; Using Secure DNS to Associate Certificates with Domain Names For S/MIME
; draft-ietf-dane-smime-15
*._smimecert CNAME _ourca-smimea
; Whatever the LHS, it all uses the one set of CAs, mine, which is ECC.
; }}}
;;; ======================================================================
; Zeroconf Delegation {{{
; Point clients at a sub-domain for Wide Area Bonjour
; "b" = browse domain
; "lb" = legacy browse domain (include domain in empty-string browses)
; "r" = registration domain
b._dns-sd._udp PTR field
lb._dns-sd._udp PTR field
r._dns-sd._udp PTR field
field NS ns1.example.org.
NS ns2.example.org.
;;;field DS 50664 7 1 8AA19AF49BFBAE7103E3450FB19E7C4B88FA556A
;;;field DS 50664 7 2 D4EEDAE5EC46C3C1A3A6DC6BC4404F36BA00E4025562A9BC8F3261A9 D0F08F96
; }}}
;;; ======================================================================
; Hosts and SSH Fingerprints {{{
; SSH fingerprints
; RFC4255 Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints
; RFC6594 Use of the SHA-256 Algorithm with RSA, Digital Signature Algorithm (DSA), and Elliptic Curve DSA (ECDSA) in SSHFP Resource Records
; http://www.iana.org/assignments/dns-sshfp-rr-parameters/dns-sshfp-rr-parameters.xml
;
; On a host with a suitably up-to-date ssh-keygen, using the .pub files:
; ssh-keygen -r $hostname -f /etc/ssh/ssh_host_$type_key.pub
;
; Records are: SSHFP ${keytype_alg} ${hash_alg} ${hash_data}
; keytype_alg: 1/RSA 2/DSA 3/ECDSA 4/Ed25519 6/Ed448
; hash_alg: 1/SHA-1 2/SHA-256
;
;nb: SSH DSA currently constrained to 1024-bit, far too short, so dropping alg=2 from DNS
;nb: SHA-1 is dead, let's stop publishing it.
; barbican: perimeter defense {{{
; barbican runs perimeter general services, such as recursive DNS
; This is also the IP address used for NAT/RDR for private jails
; This is also now @ for example.org too.
; Deliberately no SSH here.
barbican A 192.0.2.1
barbican AAAA 2001:db8::1:1
barbican.ipv4 A 192.0.2.1
barbican.ipv6 AAAA 2001:db8::1:1
; }}}
; megalomaniac: Onlink-address for main Colo box {{{
megalomaniac A 198.51.100.254
AAAA 2001:db8:ffef::254
megalomaniac.ipv4 A 198.51.100.254
megalomaniac.ipv6 AAAA 2001:db8:ffef::254
megalomaniac SSHFP 1 2 4e9ced94d3caf2ce915f85a63ce7279d5118a79ea03dac59cf4859b825d2f619
megalomaniac SSHFP 3 2 d3556a3db83ab9ccec39dc6693dd2f3e28b178c9bba61880924821c426cc61eb
megalomaniac SSHFP 4 2 c60c9d9d4728668f5f46986ff0c5b416c5e913862c4970cbfe211a6f44a111b4
megalomaniac.ipv4 SSHFP 1 2 4e9ced94d3caf2ce915f85a63ce7279d5118a79ea03dac59cf4859b825d2f619
megalomaniac.ipv4 SSHFP 3 2 d3556a3db83ab9ccec39dc6693dd2f3e28b178c9bba61880924821c426cc61eb
megalomaniac.ipv4 SSHFP 4 2 c60c9d9d4728668f5f46986ff0c5b416c5e913862c4970cbfe211a6f44a111b4
megalomaniac.ipv6 SSHFP 1 2 4e9ced94d3caf2ce915f85a63ce7279d5118a79ea03dac59cf4859b825d2f619
megalomaniac.ipv6 SSHFP 3 2 d3556a3db83ab9ccec39dc6693dd2f3e28b178c9bba61880924821c426cc61eb
megalomaniac.ipv6 SSHFP 4 2 c60c9d9d4728668f5f46986ff0c5b416c5e913862c4970cbfe211a6f44a111b4
; }}}
; tower is the main login jail {{{
tower A 192.0.2.42
tower AAAA 2001:db8::1:42
tower.ipv4 A 192.0.2.42
tower.ipv6 AAAA 2001:db8::1:42
tower SSHFP 1 2 0f211d236e94768911a294f38653c4af6fa935a5b06c975d8162f59142571451
tower SSHFP 3 2 88bf7b7401c11fa2e84871efb06cd73d8fc409154605b354db2dda0b82fe1160
tower SSHFP 4 2 6d30900be0faaae73568fc007a87b4d076cf9a351ecacc1106aef726c34ad61d
tower.ipv4 SSHFP 1 2 0f211d236e94768911a294f38653c4af6fa935a5b06c975d8162f59142571451
tower.ipv4 SSHFP 3 2 88bf7b7401c11fa2e84871efb06cd73d8fc409154605b354db2dda0b82fe1160
tower.ipv4 SSHFP 4 2 6d30900be0faaae73568fc007a87b4d076cf9a351ecacc1106aef726c34ad61d
tower.ipv6 SSHFP 1 2 0f211d236e94768911a294f38653c4af6fa935a5b06c975d8162f59142571451
tower.ipv6 SSHFP 3 2 88bf7b7401c11fa2e84871efb06cd73d8fc409154605b354db2dda0b82fe1160
tower.ipv6 SSHFP 4 2 6d30900be0faaae73568fc007a87b4d076cf9a351ecacc1106aef726c34ad61d
; }}}
; vcs for svn and git {{{
vcs A 192.0.2.228
vcs AAAA 2001:db8::48:4558:4456:4353
vcs.ipv4 A 192.0.2.228
vcs.ipv6 AAAA 2001:db8::48:4558:4456:4353
git CNAME vcs
git.ipv4 CNAME vcs.ipv4
git.ipv6 CNAME vcs.ipv6
; svn is kerberized so has its own hostname and is only IPv6-accessible because
; we don't have IPv4 to spare for this.
svn AAAA 2001:db8::48:4558:73:766e
vcs SSHFP 1 2 b518be390babdf43cb2d598aa6befa6ce6878546bf107b829d0cfc65253a97d4
vcs SSHFP 3 2 e92545dc0bf501f72333ddeb7a37afc2c5b408ce39a3ad95fbc66236f0077323
vcs SSHFP 4 2 02289441124a487095a6cda2e946c6a8ed9087faf3592ec4135536c3e615521c
vcs.ipv4 SSHFP 1 2 b518be390babdf43cb2d598aa6befa6ce6878546bf107b829d0cfc65253a97d4
vcs.ipv4 SSHFP 3 2 e92545dc0bf501f72333ddeb7a37afc2c5b408ce39a3ad95fbc66236f0077323
vcs.ipv4 SSHFP 4 2 02289441124a487095a6cda2e946c6a8ed9087faf3592ec4135536c3e615521c
vcs.ipv6 SSHFP 1 2 b518be390babdf43cb2d598aa6befa6ce6878546bf107b829d0cfc65253a97d4
vcs.ipv6 SSHFP 3 2 e92545dc0bf501f72333ddeb7a37afc2c5b408ce39a3ad95fbc66236f0077323
vcs.ipv6 SSHFP 4 2 02289441124a487095a6cda2e946c6a8ed9087faf3592ec4135536c3e615521c
; }}}
; nsauth is the authoritative DNS server {{{
nsauth A 192.0.2.53
nsauth AAAA 2001:db8::53:1
nsauth.ipv4 A 192.0.2.53
nsauth.ipv6 AAAA 2001:db8::53:1
nsauth SSHFP 1 2 895804ae022fff643b2677563cb850607c5bb564d9919896c521098c8abc40f2
nsauth SSHFP 3 2 28a65470badae611375747e1a803211c41e3d71e97741fa92ccbdf7b01f34e42
nsauth SSHFP 4 2 6e10445c0649c03fa83e18b1873e5b89b3a20893ecb48d01e7cedb3dd563ecf0
nsauth.ipv4 SSHFP 1 2 895804ae022fff643b2677563cb850607c5bb564d9919896c521098c8abc40f2
nsauth.ipv4 SSHFP 3 2 28a65470badae611375747e1a803211c41e3d71e97741fa92ccbdf7b01f34e42
nsauth.ipv4 SSHFP 4 2 6e10445c0649c03fa83e18b1873e5b89b3a20893ecb48d01e7cedb3dd563ecf0
nsauth.ipv6 SSHFP 1 2 895804ae022fff643b2677563cb850607c5bb564d9919896c521098c8abc40f2
nsauth.ipv6 SSHFP 3 2 28a65470badae611375747e1a803211c41e3d71e97741fa92ccbdf7b01f34e42
nsauth.ipv6 SSHFP 4 2 6e10445c0649c03fa83e18b1873e5b89b3a20893ecb48d01e7cedb3dd563ecf0
; These are the entries which appear in glue
ns1 A 192.0.2.53
ns1 AAAA 2001:db8::53:1
ns2 A 203.0.113.53
ns2 AAAA 2001:db8:113::53
; }}}
; hermes for mail {{{
; The raw IPv6 for this match the SMTP and IMAP _submission_ aliases
; for various reasons, but not the MX IPv6 (which also goes there).
hermes A 192.0.2.25
hermes AAAA 2001:db8::48:4558:736d:7470
hermes AAAA 2001:db8::48:4558:696d:6170
hermes.ipv4 A 192.0.2.25
hermes.ipv6 AAAA 2001:db8::48:4558:736d:7470
hermes.ipv6 AAAA 2001:db8::48:4558:696d:6170
hermes SSHFP 1 2 4472ff5bd0528cd49216af4503ba6a1c48f121d0292a31d6af193e5000af4966
hermes SSHFP 3 2 eaba20c1565676a5229184ccfcf82d0ee408f91757a67d9fa51a0b6f3db4a33b
hermes SSHFP 4 2 a9d89920e599d04363c8b35a4ce66c1ed257ea1d16981f060b6aed080bbb7a7c
hermes.ipv4 SSHFP 1 2 4472ff5bd0528cd49216af4503ba6a1c48f121d0292a31d6af193e5000af4966
hermes.ipv4 SSHFP 3 2 eaba20c1565676a5229184ccfcf82d0ee408f91757a67d9fa51a0b6f3db4a33b
hermes.ipv4 SSHFP 4 2 a9d89920e599d04363c8b35a4ce66c1ed257ea1d16981f060b6aed080bbb7a7c
hermes.ipv6 SSHFP 1 2 4472ff5bd0528cd49216af4503ba6a1c48f121d0292a31d6af193e5000af4966
hermes.ipv6 SSHFP 3 2 eaba20c1565676a5229184ccfcf82d0ee408f91757a67d9fa51a0b6f3db4a33b
hermes.ipv6 SSHFP 4 2 a9d89920e599d04363c8b35a4ce66c1ed257ea1d16981f060b6aed080bbb7a7c
; }}}
; other top-level base service hostnames (no SSH) {{{
; other IPv4 and IPv6 is routed to unredoubted and then configured up locally
kerb-service A 192.0.2.88
kerb-service AAAA 2001:db8::48:4558:6b65:7262
security A 192.0.2.92
security AAAA 2001:db8::48:4558:53:4543
security.ipv4 A 192.0.2.92
security.ipv6 AAAA 2001:db8::48:4558:53:4543
services A 192.0.2.93
services AAAA 2001:db8::48:4558:5345:5256
services.ipv4 A 192.0.2.93
services.ipv6 AAAA 2001:db8::48:4558:5345:5256
; }}}
; CNAMEs and things we wish were ALIAS or auto-made: {{{
; https://www.ietf.org/id/draft-koch-openpgp-webkey-service-07.txt
; (thru -06 it was SRV records); this is constructed from the email address,
; so we don't need .ipvX variants.
; I don't want CNAME as target of SRV; so grep-bait: CNAME security
openpgpkey A 192.0.2.92
openpgpkey AAAA 2001:db8::48:4558:53:4543
finger CNAME barbican
finger.ipv4 CNAME barbican.ipv4
finger.ipv6 CNAME barbican.ipv6
; avatars can't be a CNAME and the target of an SRV.
; greb-bait: CNAME services
avatars A 192.0.2.93
AAAA 2001:db8::48:4558:5345:5256
dict CNAME services
people CNAME services
people.ipv4 CNAME services.ipv4
people.ipv6 CNAME services.ipv6
wpad CNAME services
www CNAME services
www.ipv4 CNAME services.ipv4
www.ipv6 CNAME services.ipv6
; }}}
; Hosts and SSH Fingerprints }}}
;;; ======================================================================
; Zone Identity Services {{{
; CAA: originally:RFC 6844 ; currently: RFC 8659, with extensions in RFC 8657
;
; issue/issuewild tags use values which are "rest of data" (not Strings, no 255
; limit) and which are a domain name, followed optionally by parameters, each
; individual parameter preceded by a `;` semi-colon; parameters are defined
; per-Issuer. A missing domain-name is allowed, no parameters defined for that
; case.
;
; Even though RFC 8659 says "The semantics of parameters to the issue Property
; Tag are determined by the Issuer alone.", RFC 8657 proceeds to define
; semantics for some parameters. I think this is more "if folks do stick to
; one common schema then it's easier for others to build tools, but still each
; Issuer can set their own meanings and ignore this if they really want".
; This is backed by 8657 IANA Considerations.
; But then 8657 then imposes MUST requirements upon ACME-using systems.
;
; RFC 8657 adds: `accounturi`, `validationmethods`; can repeat the CAA record
; with the same domain but a different accounturi each time.
; https://docs.aws.amazon.com/acm/latest/userguide/setup-caa.html
; Any of: "amazon.com" "amazontrust.com" "awstrust.com" "amazonaws.com"
; No info re RFC8657 as of 2019-12-31
;
; https://letsencrypt.org/docs/caa/
; "Let’s Encrypt’s identifying domain name for CAA is letsencrypt.org. This is officially documented in our Certification Practice Statement (CPS), section 4.2.1."
; https://letsencrypt.org/documents/isrg-cps-v2.0/
; ISRG checks for relevant CAA records prior to issuing certificates. The CA acts in accordance with CAA records if present. The CA’s CAA identifying domain is ‘letsencrypt.org’.
; 2019-12-31: can find no docs re accounturi, but community forum posts
; showing that the account from the ACME client data works (after a bug was
; fixed re ACMEv2 URLs)
;
; https://www.digicert.com/dns-caa-rr-check.htm
; Equivalent: "digicert.com" "www.digicert.com" "digicert.ne.jp" "cybertrust.ne.jp" "symantec.com" "thawte.com" "geotrust.com" "rapidssl.com"
; 2019-12-31: no accounturi docs
;
; https://ccadb-public.secure.force.com/ccadb/AllCAAIdentifiersReport
; HTML page, all CAA identifiers known to the Common CA Database; <https://www.ccadb.org/resources>
; 2019-12-31: I am not using Amazon inside example.org domain; that's on the blog at bridge.example.com
; <https://crt.sh/?q=%25.example.org> only lists LE.
; Beware that our LetsEncrypt automation tooling uses multiple email addresses
; for different purposes, but all hostnames within example.org are using the
; noc@example.org address, so that's the only one we need.
; Let's Encrypt:
; Prod/1234567 == tower / noc@example.org
; Stag/23456789 = chat2 / noc+chat2@example.net
; Prod/76543210 = chat2 / noc+chat2@example.net
@ CAA 0 issue "example.net"
@ CAA 0 issue "letsencrypt.org\; accounturi=https://acme-v01.api.letsencrypt.org/acme/reg/1234567"
@ CAA 0 issue "letsencrypt.org\; accounturi=https://acme-staging-v02.api.letsencrypt.org/acme/acct/23456789"
@ CAA 0 issue "letsencrypt.org\; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/76543210"
;@ CAA 0 issue "amazonaws.com"
@ CAA 0 issuewild ";"
@ CAA 0 iodef "mailto:security@example.org"
; Zone Identity Services }}}
;;; ======================================================================
; TLSA Records {{{
; TLSA: Usage Selector Matching-Type CAdata
; Usage==2 : CA anchor, no PKIX requirement
; Selector==0 : match entire cert
; Selector==1 : match public key
; MT: 0=exact match, 1=sha256, 2=sha512
; RFCs: 6698 6394
; Naming from RFC 7218 (draft-ietf-dane-registry-acronyms-03.txt):
; * Usages: PKIX-TA(0) PKIX-EE(1) DANE-TA(2) DANE-EE(3) PrivCert(255)
; * Selectors: Cert(0) SPKI(1) PrivSel(255)
; * Matching Types: Full(0) SHA2-256(1) SHA2-512(2) PrivMatch(255)
; We don't use -example-tlsa-full any more; that was our v3 CA, and in the meantime
; the client tooling for TLSA has matured and we can use better matching.
;
; _example-tlsa-full TLSA ( 2 0 0 30.... ) ; OurCA3 PKIX-less trust anchor
;
; openssl x509 -inform pem -outform der -in OurCA3.pem| perl -pe 's/(.)/sprintf "%02x", ord $1/aesg';echo
; openssl x509 -inform pem -outform der -in OurCA3.pem| perl -pe 's/(.)/sprintf "%02x", ord $1/aesg' | perl -pe 's/(.{72})/$1\n/g';echo
; For our own CAs, we use Selector 0 to match the entire cert, because we
; control the horizontal and the vertical.
; For CAs we use, we use Selector 1, so that if they reissue their signing cert
; then our DNS records remain valid: as long the as public key is unchanged,
; the 2/1/1 will be unchanged too.
;
; We typically avoid 3/x/x for individual certs or public keys directly in DNS:
; we don't want to have to update a static zonefile for cert re-issuance, and
; even with a dynamic zonefile, any complicated pre-issuance schemes or timing
; dances to deal with DNS TTLs fall down when there's an emergency revocation
; or replacement. Just pin the issuing CA with 2/x/x and be done with it.
; OurCA {{{
_ourcaca4-tlsa TLSA ( ; OurCA4 PKIX-less trust anchor
02 00 01 ea99063a0a3bda9727032cf82da238698b90ba729300703d3956943635f96488
; TLSA DANE-TA CERT SHA2-256
)
; danetool --tlsa-rr --host=foo --ca --x509 --load-certificate=OurCA4.pem
_ourcaca5-tlsa TLSA ( ; OurCA5 PKIX-less trust anchor
02 00 01 11f058f61f97b8adc66ef4801f918c71b10e5c1e3d39afde10408b3026647ef1
; TLSA DANE-TA CERT SHA2-256
)
; danetool --tlsa-rr --host=foo --ca --x509 --load-certificate=OurCA5.pem
; SMIMEA {{{
; Note that the SMIME email signatures include the CA usually; mutt certainly does,
; so folks getting signed email from me _have_ the CA. So no need to use 2/0/0 here.
;
; That _was_:
; openssl x509 -inform pem -outform der -in OurCA5.pem | perl -pe 's/(.)/sprintf "%02x", ord $1/aesg' | perl -pe 's/(.{72})/$1\n/g';echo
;
; but instead we can just use the signatures.
; Since it's just an X.509 cert and almost the same as a TLSA record, use danetool.
; Heck, copy the _ourcaca5-tlsa RRset and change the RRtypes.
;;;_ourcaca5-smimea SMIMEA ( ; OurCA5 PKIX-less trust anchor
;;; 02 00 01 11f058f61f97b8adc66ef4801f918c71b10e5c1e3d39afde10408b3026647ef1
;;; ; SMIMEA DANE-TA CERT SHA2-256
;;; )
; danetool --tlsa-rr --host=foo --ca --x509 --load-certificate=OurCA5.pem
; This one should be a _set_ of CAs, letting me add OurCA6 (Ed25519) when the time comes.
;;;_ourca-smimea SMIMEA ( ; OurCA5 PKIX-less trust anchor
;;; 02 00 01 11f058f61f97b8adc66ef4801f918c71b10e5c1e3d39afde10408b3026647ef1
;;; ; SMIMEA DANE-TA CERT SHA2-256
;;; )
; OurCA }}}
; SMIMEA }}}
; Other CAs, standalone {{{
_cacert-c3-tlsa TLSA ( ; CACert Class 3 PKIX-less trust anchor
02 00 01 4edde9e55ca453b388887caa25d5c5c5bccf2891d73b87495808293d5fac83c8
; TLSA DANE-TA CERT SHA2-256
)
; danetool --tlsa-rr --host=foo --ca --x509 --load-certificate=cacert-class3.pem
; For Let's Encrypt, where they have multiple signing paths, we use public-key
; hashing, not certificate hashing.
; This avoids breakage given, eg, IdenTrust vs other authority paths
;
;_letsencrypt-tlsa TLSA ( 02 01 01 0b9fa5a59eed715c26c1020c711b4f6ec42d58b0015e14337a39dad301c5afc3 ) ; ISRG Root X1
_letsencrypt-tlsa TLSA ( 02 01 01 60b87575447dcba2a36b7d11ac09fb24a9db406fee12d2cc90180517616e8a18 ) ; X1 & X3
_letsencrypt-tlsa TLSA ( 02 01 01 b111dd8a1c2091a89bd4fd60c57f0716cce50feeff8137cdbee0326e02cf362b ) ; X2 & X4
; danetool --tlsa-rr --host=foo --ca --load-certificate=letsencrypt_rsa_authority_x1.pem
; edit results of: for F in AmazonRootCA*; danetool --tlsa-rr --host=$F --ca --x509 --load-certificate=$F
_amazon-tlsa TLSA ( 02 00 01 8ecde6884f3d87b1125ba31ac3fcb13d7016de7f57cc904fe1cb97c6ae98196e ) ; AmazonRootCA1
_amazon-tlsa TLSA ( 02 00 01 1ba5b2aa8c65401a82960118f80bec4f62304d83cec4713a19c39c011ea46db4 ) ; AmazonRootCA2
_amazon-tlsa TLSA ( 02 00 01 18ce6cfe7bf14e60b2e347b8dfe868cb31d02ebb3ada271569f50343b46db3a4 ) ; AmazonRootCA3
_amazon-tlsa TLSA ( 02 00 01 e35d28419ed02025cfa69038cd623962458da5c695fbdea3c22b0bfb25897092 ) ; AmazonRootCA4
; Other CAs, standalone }}}
; Combined CA TLSA records {{{
; These let us migrate between CAs without any outage, or have contingency plans.
; _ourca-tlsa is a pairing anchor, handling both CA4 and CA5.
_ourca-tlsa TLSA ( 02 00 01 ea99063a0a3bda9727032cf82da238698b90ba729300703d3956943635f96488 ) ; OurCA4
_ourca-tlsa TLSA ( 02 00 01 11f058f61f97b8adc66ef4801f918c71b10e5c1e3d39afde10408b3026647ef1 ) ; OurCA5
; Used for migrations CACert -> OurCA4
_ourca-cacert-tlsa TLSA 02 00 01 ea99063a0a3bda9727032cf82da238698b90ba729300703d3956943635f96488 ; OurCA4
_ourca-cacert-tlsa TLSA 02 00 01 11f058f61f97b8adc66ef4801f918c71b10e5c1e3d39afde10408b3026647ef1 ; OurCA5
_ourca-cacert-tlsa TLSA 02 00 01 4edde9e55ca453b388887caa25d5c5c5bccf2891d73b87495808293d5fac83c8 ; cacert-c3
; This mostly means "stuff which used to be on our own CA but for which we now use Let's Encrypt because others might see it"
_ourca-le-tlsa TLSA ( 02 00 01 ea99063a0a3bda9727032cf82da238698b90ba729300703d3956943635f96488 ) ; OurCA4
_ourca-le-tlsa TLSA ( 02 00 01 11f058f61f97b8adc66ef4801f918c71b10e5c1e3d39afde10408b3026647ef1 ) ; OurCA5
_ourca-le-tlsa TLSA ( 02 01 01 60b87575447dcba2a36b7d11ac09fb24a9db406fee12d2cc90180517616e8a18 ) ; letsencrypt X1 & X3
_ourca-le-tlsa TLSA ( 02 01 01 b111dd8a1c2091a89bd4fd60c57f0716cce50feeff8137cdbee0326e02cf362b ) ; letsencrypt X2 & X4
; Don't ask
_ourca-cacert-le-tlsa TLSA ( 02 00 01 ea99063a0a3bda9727032cf82da238698b90ba729300703d3956943635f96488 ) ; OurCA4
_ourca-cacert-le-tlsa TLSA ( 02 00 01 11f058f61f97b8adc66ef4801f918c71b10e5c1e3d39afde10408b3026647ef1 ) ; OurCA5
_ourca-cacert-le-tlsa TLSA ( 02 00 01 4edde9e55ca453b388887caa25d5c5c5bccf2891d73b87495808293d5fac83c8 ) ; cacert-c3
_ourca-cacert-le-tlsa TLSA ( 02 01 01 60b87575447dcba2a36b7d11ac09fb24a9db406fee12d2cc90180517616e8a18 ) ; letsencrypt X1 & X3
_ourca-cacert-le-tlsa TLSA ( 02 01 01 b111dd8a1c2091a89bd4fd60c57f0716cce50feeff8137cdbee0326e02cf362b ) ; letsencrypt X2 & X4
; Stuff we migrate from CACert to Let's Encrypt; was never private CA, we
; always wanted others to be able to validate.
_cacert-le-tlsa TLSA ( 02 00 01 4edde9e55ca453b388887caa25d5c5c5bccf2891d73b87495808293d5fac83c8 ) ; cacert-c3
_cacert-le-tlsa TLSA ( 02 01 01 60b87575447dcba2a36b7d11ac09fb24a9db406fee12d2cc90180517616e8a18 ) ; letsencrypt X1 & X3
_cacert-le-tlsa TLSA ( 02 01 01 b111dd8a1c2091a89bd4fd60c57f0716cce50feeff8137cdbee0326e02cf362b ) ; letsencrypt X2 & X4
; Some stuff we move between LE and AWS CloudFront in front of an S3 bucket
_le-amazon-tlsa TLSA ( 02 01 01 60b87575447dcba2a36b7d11ac09fb24a9db406fee12d2cc90180517616e8a18 ) ; letsencrypt X1 & X3
_le-amazon-tlsa TLSA ( 02 01 01 b111dd8a1c2091a89bd4fd60c57f0716cce50feeff8137cdbee0326e02cf362b ) ; letsencrypt X2 & X4
_le-amazon-tlsa TLSA ( 02 00 01 8ecde6884f3d87b1125ba31ac3fcb13d7016de7f57cc904fe1cb97c6ae98196e ) ; AmazonRootCA1
_le-amazon-tlsa TLSA ( 02 00 01 1ba5b2aa8c65401a82960118f80bec4f62304d83cec4713a19c39c011ea46db4 ) ; AmazonRootCA2
_le-amazon-tlsa TLSA ( 02 00 01 18ce6cfe7bf14e60b2e347b8dfe868cb31d02ebb3ada271569f50343b46db3a4 ) ; AmazonRootCA3
_le-amazon-tlsa TLSA ( 02 00 01 e35d28419ed02025cfa69038cd623962458da5c695fbdea3c22b0bfb25897092 ) ; AmazonRootCA4
; All The Current Bases
_ourca-le-amazon-tlsa TLSA ( 02 00 01 ea99063a0a3bda9727032cf82da238698b90ba729300703d3956943635f96488 ) ; OurCA4
_ourca-le-amazon-tlsa TLSA ( 02 00 01 11f058f61f97b8adc66ef4801f918c71b10e5c1e3d39afde10408b3026647ef1 ) ; OurCA5
_ourca-le-amazon-tlsa TLSA ( 02 01 01 60b87575447dcba2a36b7d11ac09fb24a9db406fee12d2cc90180517616e8a18 ) ; letsencrypt X1 & X3
_ourca-le-amazon-tlsa TLSA ( 02 01 01 b111dd8a1c2091a89bd4fd60c57f0716cce50feeff8137cdbee0326e02cf362b ) ; letsencrypt X2 & X4
_ourca-le-amazon-tlsa TLSA ( 02 00 01 8ecde6884f3d87b1125ba31ac3fcb13d7016de7f57cc904fe1cb97c6ae98196e ) ; AmazonRootCA1
_ourca-le-amazon-tlsa TLSA ( 02 00 01 1ba5b2aa8c65401a82960118f80bec4f62304d83cec4713a19c39c011ea46db4 ) ; AmazonRootCA2
_ourca-le-amazon-tlsa TLSA ( 02 00 01 18ce6cfe7bf14e60b2e347b8dfe868cb31d02ebb3ada271569f50343b46db3a4 ) ; AmazonRootCA3
_ourca-le-amazon-tlsa TLSA ( 02 00 01 e35d28419ed02025cfa69038cd623962458da5c695fbdea3c22b0bfb25897092 ) ; AmazonRootCA4
; Combined CA TLSA records }}}
; TLSA Records }}}
;;; ======================================================================
; TLSA Referencing {{{
; full:
; openssl x509 -inform pem -outform der -in OurCA3.pem| perl -pe 's/(.)/sprintf "%02x", ord $1/aesg' | perl -pe 's/(.{72})/$1\n/g';echo
; short:
; danetool --tlsa-rr --host=foo --ca --x509 --load-certificate=some-company.classN.server.shaN.ca.pem
; Web and other HTTP Transport
_443._tcp.www CNAME _ourca-le-tlsa
_443._tcp.www.ipv4 CNAME _ourca-le-tlsa
_443._tcp.www.ipv6 CNAME _ourca-le-tlsa
_443._tcp.people CNAME _ourca-le-tlsa
_443._tcp.people.ipv4 CNAME _ourca-le-tlsa
_443._tcp.people.ipv6 CNAME _ourca-le-tlsa
_443._tcp.git CNAME _ourca-le-tlsa
_443._tcp.svn CNAME _ourca-le-tlsa
; XMPP / Jabber
_5222._tcp.xmpp CNAME _ourca-le-tlsa
_5223._tcp.xmpp CNAME _ourca-le-tlsa
_5269._tcp.xmpp-s2s CNAME _ourca-le-tlsa
; Email
_25._tcp.mx CNAME _ourca-le-tlsa
_26._tcp.mx CNAME _ourca-le-tlsa
_27._tcp.mx CNAME _ourca-le-tlsa
; the ....46 are the SRV results, the non-46 may be manually configured
; the 1xxx are for potential debugging
; there's too much historical cruft here, from when I had one IPv4 address and
; a bazillion IPv6 addresses.
_465._tcp.smtp46 CNAME _ourca-le-tlsa
_587._tcp.smtp46 CNAME _ourca-le-tlsa
_1465._tcp.smtp46 CNAME _ourca-le-tlsa
_1587._tcp.smtp46 CNAME _ourca-le-tlsa
_465._tcp.smtp CNAME _ourca-le-tlsa
_587._tcp.smtp CNAME _ourca-le-tlsa
_1465._tcp.smtp CNAME _ourca-le-tlsa
_1587._tcp.smtp CNAME _ourca-le-tlsa
_143._tcp.imap46 CNAME _ourca-le-tlsa
_993._tcp.imap46 CNAME _ourca-le-tlsa
_143._tcp.imap CNAME _ourca-le-tlsa
_993._tcp.imap CNAME _ourca-le-tlsa
; except for sieve, where there's only IPv6
_4190._tcp.imap CNAME _ourca-le-tlsa
;
www.security CNAME security
www.security.ipv4 CNAME security.ipv4
www.security.ipv6 CNAME security.ipv6
_443._tcp.www.security CNAME _ourca-le-tlsa
_443._tcp.www.security.ipv4 CNAME _ourca-le-tlsa
_443._tcp.www.security.ipv6 CNAME _ourca-le-tlsa
_443._tcp.security CNAME _ourca-le-tlsa
_443._tcp.security.ipv4 CNAME _ourca-le-tlsa
_443._tcp.security.ipv6 CNAME _ourca-le-tlsa
; _acme-challenge.www.security.example.org. 120 TXT "..."
; _acme-challenge.security.example.org. 120 TXT "..."
; beware SAN : one each
; rather low TTL because some things might be using this as their backoff determination, buggily.
;
; This does require that the ACME client correctly remap domains to update in
; DNS before asking for a validation of the unmapped domain. The tool I used
; in 2020-02 claimed such support but it was buggy and I had to abandon this
; approach. Instead, we have the nginx vhost which handles a bare
; "example.org" handle /.well-known/acme-challenge/ by trying local files
; first, else HTTP proxying to the chat server.
; I'd like to get rid of that proxying and switch back to DNS updating;
; "d.example.net" is delegated to a commercial service which has an API with
; near-instant live updates.
_acme-challenge 15 CNAME _acme-challenge.chat-acme.d.example.net.
_acme-challenge.xmpp 15 CNAME _acme-challenge.xmpp.chat-acme.d.example.net.
_acme-challenge.chat 15 CNAME _acme-challenge.chat.chat-acme.d.example.net.
_acme-challenge.conference 15 CNAME _acme-challenge.conference.chat-acme.d.example.net.
_acme-challenge.proxy-chatfiles 15 CNAME _acme-challenge.proxy-chatfiles.chat-acme.d.example.net.
_acme-challenge.pubsub.xmpp 15 CNAME _acme-challenge.pubsub.xmpp.chat-acme.d.example.net.
; TLSA Referencing }}}
;;; ======================================================================
; Mail server hostnames {{{
; Willing to sacrifice Kerberos portability and rely upon disabling reverse DNS
; hostname canonicalization. Sucking it up. Still no reliable IPv6 at home.
; :(
; For /etc/krb5.conf: [libdefaults] dns_canonicalize_hostname = false
;
imap AAAA 2001:db8::48:4558:696d:6170
A 192.0.2.25
smtp AAAA 2001:db8::48:4558:736d:7470
A 192.0.2.25
;
smtp46 A 192.0.2.25 ; old alias pre-dating IPv4 in smtp
AAAA 2001:db8::48:4558:736d:7470
imap46 A 192.0.2.25 ; old alias pre-dating IPv4 in imap
AAAA 2001:db8::48:4558:696d:6170
; If changing this, then also update the SPF record; it hard-codes these for
; efficiency of remote systems, saving them some lookups.
; Really, we should be constructing the SPF record via a macro of some kind.
; I'm trying to avoid using M4 to make this zonefile, but sometimes with some
; good whiskey, that looks mighty tempting.
mx A 192.0.2.25
AAAA 2001:db8::48:4558:736d:7470
mx.ipv4 A 192.0.2.25
mx.ipv6 AAAA 2001:db8::48:4558:736d:7470
;
; RFC 7208 section 10.1.3
; HELO hostnames need to have SPF to allow processing for bounces
; In short: there is no envelope sender for bounces, so the only thing which
; can be checked in the HELO name.
;
; This needs to be tied to the exim.conf setup for outbound `helo_data` on
; transports. At this time, that's "mx.example.org"; this needs to also
; match the `interface` IP address list.
; We do not need to allow other email service providers to claim to be this
; host, so we use "a" (for A/AAAA matching), a catchall for our IPs, and a
; *hard* reject on any other IP.
; Because we never send email from mx.example.org and it's only used by HELO
; checks, we can be firm and not have to worry about forwarding or other
; legitimate shenanigans.
mx TXT "v=spf1 a include:_spflarge.example.net -all"
; RFC 8461 SMTP MTA Strict Transport Security (MTA-STS)
; Final: `_mta-sts` TXT record, `v=STSv1`, with host records on `mta-sts`:
; https://mta-sts.example.com/.well-known/mta-sts.txt
;
;; History:
;;; https://tools.ietf.org/html/draft-ietf-uta-mta-sts-02
;;; SMTP MTA Strict Transport Security (MTA-STS)
;;; Draft -03 renames to "mta-sts", to match the hostname which has to resolve anyway,
;;; which makes sense: NXDOMAIN can skip a second lookup.
;;; https://tools.ietf.org/html/draft-ietf-uta-mta-sts-03
;;; NB: draft -15 in now in last call, and by this point:
;;; + it's .txt, not .json
;;; + the allowed fields for the mode have changed (`report` -> `testing`)
;;; + DNS is back to _mta-sts
;
; IP addresses should match `services`; this is ALIAS record stuff, can't use
; CNAME because need TXT record too, for the draft, but can switch back to CNAME
; if ignoring the draft.
;
; If updating version, don't forget to check globnix.org DNS too!
_mta-sts TXT "v=STSv1; id=20191231r1;"
mta-sts TXT "v=STSv1; id=20191231r1;"
mta-sts A 192.0.2.93
mta-sts AAAA 2001:db8::48:4558:5345:5256
; Mail server hostnames }}}
;;; ======================================================================
; Chat server hostnames {{{
; $HostingProvider chat2.example.net
; ipv4: 203.0.113.175
; ipv6: 2001:db8::f0ab:cdef:1234:f00f
;
xmpp.ipv6 AAAA 2001:db8::f0ab:cdef:1234:f00f
xmpp-s2s.ipv6 AAAA 2001:db8::f0ab:cdef:1234:f00f
xmpp A 203.0.113.175
AAAA 2001:db8::f0ab:cdef:1234:f00f
xmpp-s2s A 203.0.113.175
AAAA 2001:db8::f0ab:cdef:1234:f00f
proxy-chatfiles CNAME xmpp
fileproxy.xmpp CNAME xmpp
; Federated services which are offered under their own hostnames (even if on
; the same server instance and port) federate with the same mechanisms, so you
; need an SRV or just an address record if on the default ports.
; Which remote servers will actually use SRV is more open to question.
conference CNAME xmpp-s2s
_xmpp-server._tcp.conference SRV 10 2 5269 xmpp-s2s
; Services which are modules and need their own hostnames, but are not
; federated within XMPP, don't need the SRV record
pubsub.xmpp CNAME xmpp-s2s
chat A 203.0.113.175
AAAA 2001:db8::f0ab:cdef:1234:f00f
proxy-chatfiles.chat CNAME chat
fileproxy.chat CNAME chat
conference.chat CNAME chat
pubsub.chat CNAME chat
_xmpp-server._tcp.conference SRV 10 2 5269 chat
; Chat server hostnames }}}
;;; ======================================================================
; Random other hostnames {{{
auth AAAA 2001:db8::48:4558:6175:7468
kpeople AAAA 2001:db8::48:4558:6b70:706c
ocsp.security AAAA 2001:db8::48:4558:6f63:7370
webauth AAAA 2001:db8::48:4558:7765:6261
news-feed A 192.0.2.93
AAAA 2001:db8::48:4558:6e6e:7470
; This is for Go package downloads, keeping the canonical names of modules
; in domains under our control, so that we're not locked into one code-hosting
; provider.
go CNAME abcdefghijklmn.cloudfront.net.
; Do *not* deploy TLSA until cloudfront.net is signed
; (or we use ALIAS-type records)
;_443._tcp.go CNAME _amazon-tlsa
foo A 192.0.2.200
; Random other hostnames }}}
;;; ======================================================================
; Per-person email sub-domains {{{
; Household dedicated mail domains where *@person.example.org can receive email
; Gladys receives email here but never sends from this address
; (Gladys has probably forgotten this exists and will roll her eyes at it.)
gladys MX 10 mx
$ORIGIN gladys.example.org.
_adsp._domainkey TXT "dkim=all"
_dmarc TXT "v=DMARC1; p=none; sp=none; rua=mailto:dmarc-notify@example.org; ruf=mailto:dmarc-notify@example.org; adkim=s"
_report TXT "r=abuse-reports@example.org; rf=ARF; re=postmaster@example.org;"
_smtp._tls TXT "v=TLSRPTv1; rua=mailto:smtp-tls-reports@example.org"
_smtp-tlsrpt TXT "v=TLSRPTv1; rua=mailto:smtp-tls-reports@example.org"
$ORIGIN example.org.
; Fred sends and receives email in this domain
fred MX 10 mx
$ORIGIN fred.example.org.
; Also have a web-server for some old OpenID stuff
@ A 192.0.2.93 ; services
@ AAAA 2001:db8::48:4558:5345:5256 ; services
TXT "v=spf1 ip4:192.0.2.25 ip6:2001:db8::1:25 mx include:_spf.example.com ~all"
;
d201911._domainkey TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8/OMUa3PnWh9LqXFVwlAgYDdTtbq3zTtTOSBmJq5yWauzXYcUuSmhW7CsV0QQlacCsQgJlwg9Nl1vO1TosAj5EKUCLTeSqjlWrM7KXKPx8FT71Q9H9wXX4MHUyGrqHFo0OPzcmtHwqcd8AD6MIvJHSRoAfiPPBp8Euc0wGnJZdGS75Hk+wA3MQ2/Tlz" "P2eenyiFyqmUTAGOYsGC/tREsWPiegR/OVxNGlzTY6quHsuVK7UYtIyFnYx9PGWdl3b3p7VjQ5V0Rp+2CLtVrCuS6Zs+/3NhZdM7mdD0a9Jgxakwa1le5YmB5lHTGF7T8quy6TlKe9lMUIRNjqTHfSFz/MwIDAQAB"
d201911e2._domainkey TXT "v=DKIM1; k=ed25519; p=rQNsV9YcPJn/WYI1EDLjNbN/VuX1Hqq/oe4htbnhv+A="
;
d202003._domainkey TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvpnx7tnRxAnE/poIRbVb2i+f1uQCXWnBHzHurgEyZX0CmGaiJuCbr8SWOW2PoXq9YX8gIv2TS3uzwGv/4yA2yX9Z9zar1LeWUfGgMWLdCol9xfmWrI+6MUzxuwhw/mXwzigbI4bHoakh3ez/i3J9KPS85GfrOODqA1emR13f2pG8EzAcje+rwW2PtYj" "c0h+FMDpeLuPYyYszFbNlrkVUneesxnoz+o4x/s6P14ZoRqz5CR7u6G02HwnNaHads5Eto6FYYErUUTtFmgWuYabHxgLVGRdRQs6B5OBYT/3L2q/lAgmEgdy/QL+c0Psfj99/XQmO8fcM0scBzw2ukQzcUwIDAQAB"
d202003e2._domainkey TXT "v=DKIM1; k=ed25519; p=0DAPp/IRLYFI/Z4YSgJRi4gr7xcu1/EfJ5mjVn10aAw="
;
_adsp._domainkey TXT "dkim=all"
_dmarc TXT "v=DMARC1; p=none; sp=none; rua=mailto:dmarc-notify@example.org; ruf=mailto:dmarc-notify@example.org; adkim=s"
_report TXT "r=abuse-reports@example.org; rf=ARF; re=postmaster@example.org;"
_smtp._tls TXT "v=TLSRPTv1; rua=mailto:smtp-tls-reports@example.org"
_smtp-tlsrpt TXT "v=TLSRPTv1; rua=mailto:smtp-tls-reports@example.org"
$ORIGIN example.org.
; Per-person email sub-domains }}}
;;; ======================================================================
; {{{PGP-Keys-And-Fingerprints
; RFC4398 Storing Certificates in the Domain Name System (DNS)
; type tag algorithm <data>
; type 3 = PGP
; type 6 = IPGP
; IPGP fingerprint length, fingerprint, URL; either FP or URL may be empty
; gnupg comes with tools/make-dns-cert.c
;
; There's a lack of clarity about what clients do given a dot in the email LHS,
; so I solve it by publishing both with the dot escaped to be part of the label,
; and the dot introducing DNS hierarchy.
;
;;;fred CERT 6 0 0 FKy7QyQ5Ot41Fdot2k0ekA4UwcwEaHR0cHM6Ly93d3cuc2VjdXJpdHkuc3BvZGh1aXMub3JnL1BHUC9rZXlzLzB4NEQxRTkwMEUxNEMxQ0MwNC5hc2M=
;;;fred.bloggs CERT 6 0 0 FKy7QyQ5Ot41Fdot2k0ekA4UwcwEaHR0cHM6Ly93d3cuc2VjdXJpdHkuc3BvZGh1aXMub3JnL1BHUC9rZXlzLzB4NEQxRTkwMEUxNEMxQ0MwNC5hc2M=
;;;fred\.bloggs CERT 6 0 0 FKy7QyQ5Ot41Fdot2k0ekA4UwcwEaHR0cHM6Ly93d3cuc2VjdXJpdHkuc3BvZGh1aXMub3JnL1BHUC9rZXlzLzB4NEQxRTkwMEUxNEMxQ0MwNC5hc2M=
;
; I used:
; perl -MMIME::Base64 -le '$_ = $ARGV[0]; s/\s+//g; s/(..)/chr(hex($1))/eg;
; $_=chr(length($_)) . $_ . $ARGV[1]; print encode_base64($_, "")' \
; "$(gpg --with-colons --fingerprint $gpg_key | perl -F: -lane 'print $F[9] if $F[0] eq "fpr"')" \
; https://www.security.example.org/PGP/keys/0x0123456789ABCDEF.asc
;
; Note that my first attempt omitted the length. Oops. The first octet of
; the base64 data is the length; following octets, for that length, is the
; fingerprint, in raw binary form; any remaining octets are the URL.
; With the URL in, we might have with key 0x0123456789ABCDEF :
; FKy7QyQ5Ot41Fdot2k0ekA4UwcwEaHR0cHM6Ly93d3cuc2VjdXJpdHkuc3BvZGh1aXMub3JnL1BHUC9rZXlzLzB4NEQxRTkwMEUxNEMxQ0MwNC5hc2M=
;; WKD is https://datatracker.ietf.org/doc/draft-koch-openpgp-webkey-service/?include_text=1
;; and included above with SRV records
;; https://datatracker.ietf.org/doc/draft-ietf-dane-openpgpkey/?include_text=1
;; rev 00: so draft-ietf-dane-openpgpkey-00.txt
;; NOW: RFC 7929 (experimental)
; Generated by my gnupg-exportsof-mykey tooling; this is from output file
; dns-examplecom-pgp.openpgpkey.db
; This is the 2020 Ed25519 key. It's smaller, so it's marginally less insane
; to have it in DNS.
;
; For example.org redaction: leaving this intact, original PGP key, there
; are email addresses buried in the key, and human names. But changing
; the DNS labels and comments for zone consistency.
; You can get the original name just by looking up the fingerprint below
; the ORIGIN:
$ORIGIN _openpgpkey.example.org.
; 4833892924C60A7AE666D32A1DA3E68F41CEECAC
; Fred Bloggs <fred.bloggs@example.org>
;;;6555f290b6e653629d9d582660dd2fe730320e43e252f8e2e5ee1bdd TYPE61 \# 1239 (
;;; 9833045e2504f516092b06010401da470f0101074043c292df50b30dcaadd549
;;; cf48fd9cbc06e43c3a9ca1cb788da0bd3c00ffc750b4245068696c2050656e6e
;;; 6f636b203c7068696c4070656e6e6f636b2d746563682e636f6d3e888e041316
;;; 080036021b03030b090703150a080416030201021e0102178002190116210448
;;; 33892924c60a7ae666d32a1da3e68f41ceecac05025e250723000a09101da3e6
;;; 8f41ceecac2b46010081e1c09a255705b3fdda16a5485e6ec25edeabac78c92d
;;; aa5f6c1af2b71cc93800fe364bd0438dd5120585a034327e69757aa58ca0890a
;;; d7691cba343c55cf957806b41c5068696c2050656e6e6f636b203c7064704067
;;; 6e7570672e6e65743e888b041316080033021b03030b090703150a0804160302
;;; 01021e010217801621044833892924c60a7ae666d32a1da3e68f41ceecac0502
;;; 5e250723000a09101da3e68f41ceecac4faf00ff4bc1c3a4389cb5bb9cb90026
;;; c416f2ad99be2a6e0fe2ceea0bfa8e175e02c0eb0100eb8a11ec88b21ffa08c3
;;; 0a71afd04dc43d093fabcb9c5ae2de0b9c627e88670eb4285068696c2050656e
;;; 6e6f636b203c7068696c2e70656e6e6f636b4073706f64687569732e6f72673e
;;; 888b041316080033021b03030b090703150a080416030201021e010217801621
;;; 044833892924c60a7ae666d32a1da3e68f41ceecac05025e250724000a09101d
;;; a3e68f41ceecacc40800ff6702abcf89ddfe3ed0670953ca6a0a33ff4d6d83bf
;;; 8b4496cc299abedfb4947401008ab97f09df18813ad998de3fe3c55085b49f56
;;; ee1f68cac298be4be6d4f34906b41b5068696c2050656e6e6f636b203c706470
;;; 406578696d2e6f72673e888b041316080033021b03030b090703150a08041603
;;; 0201021e010217801621044833892924c60a7ae666d32a1da3e68f41ceecac05
;;; 025e250724000a09101da3e68f41ceecac9dbf0100f3eac82b9ef48d4cabc522
;;; 44cbd52ed9392a2ad4111d8f6b0aa33f8859e956c301008653862e15970d7601
;;; 57764064209c2ca8a9a616b1441e0e670b96458fd1a90eb838045e2504f5120a
;;; 2b0601040197550105010107401ea56299a543466023db5f4d4f1452450a393a
;;; fcb9039ada0c27e2dc7f59752f03010807887e04181608002616210448338929
;;; 24c60a7ae666d32a1da3e68f41ceecac05025e2504f5021b0c05090966018000
;;; 0a09101da3e68f41ceecac624d00fe30c7b6e6bbe930e899c270f4f17de5bdae
;;; 55612f9d69cb7490f6a4a4d04f261600ff58e26ae9fc3324de9bd51a77ff65d4
;;; 2af60294f55a03fe0f1ec316e4f5b8e70bb833045e25054016092b06010401da
;;; 470f010107406df5a87cd9b51890f84f7e597ab17e549f1ba093844178ea61ce
;;; ac484b4a58e988ef0418160800201621044833892924c60a7ae666d32a1da3e6
;;; 8f41ceecac05025e250540021b02008109101da3e68f41ceecac762004191608
;;; 001d16210436bea421261c40a54fc9261c2e7665110f8a56ff05025e25054000
;;; 0a09102e7665110f8a56ff0bb500ff4aee429d5659915336511a3b744c4c25fd
;;; d09fb8af2962c57e279b1906ad5e040100a8616e0d4def13d7910c30a595e7fc
;;; 92308de87404b96fa17325b6ef6cd7e9029f260100c2fe3edf9bbfce3c42317c
;;; a93bdbc4e52dd98bd2f782eb708edca1fbd7c345e50100dc69c0cc5a2481dc79
;;; 08162d7c6d185c8866498eb87d159e0eb3877d68de2b02
;;; )
; {{{PGP-PKA-Records
; Phil notes, since the actual records below are "as output by gpg" for easier maintenance.
; TYPE37 == CERT
; During early GnuPG 2.1.x, GnuPG switched from v1 PKA to v2; details at:
; <https://incenp.org/notes/2015/keys-in-dns.html>
; => local-part is zooko's base32 of LHS (as seen from src), type is CERT/IPGP, no URL
; so _very_ similar to the records already above where I chose to use CERT/IPGP ages ago.
;
; pip install zbase32 ; python # zbase32 is python2-only
; import hashlib, zbase32
; lhs = 'fob' # fred o bloggs
; print(zbase32.zbase32.b2a(hashlib.sha1(lhs.lower()).digest()))
; That gets us the left-hand-side.
;
; Skimming code, it looks as though the PKA lookup really does just re-use the older IPGP
; code, which can return a URL; `gpg2.1.15 --auto-key-locate pka` got a fingerprint but then
; errored on getting the key. So instead, let's experiment by grabbing our own CERT from above,
; shoving it into this namespace and changing the LHS to use the zb32 encoded variants
; (which also handles `.` vs `\.` issues).
;
; Discovery from log.dirmngr : tries to access
; <https://www.security.example.org:443/pks/lookup?op=get&options=mr&search=0x0123456789ABCDEF0123456789ABCDEF01234567>
; Okay, so change the hostname to `sks.example.org` and we should be good, as the PGP keyserver will get it
; % perl -MMIME::Base64 -le '$_ = $ARGV[0]; s/\s+//g; s/(..)/chr(hex($1))/eg;
; $_=chr(length($_)) . $_ . $ARGV[1]; print encode_base64($_, "")' \
; "$(gpg --with-colons --fingerprint $pgp_key_main | perl -F: -lane 'print $F[9] if $F[0] eq "fpr"')" \
; https://sks.example.org
; FKy7QyQ5Ot41Fdot2k0ekA4UwcwEaHR0cHM6Ly9za3Muc3BvZGh1aXMub3Jn
;
; 2018-07-14 after turning down sks.example.org:
; % perl -MMIME::Base64 -le '$_ = $ARGV[0]; s/\s+//g; s/(..)/chr(hex($1))/eg; $_=chr(length($_)) . $_ . $ARGV[1]; print encode_base64($_, "")' \
; "$(gpg --with-colons --fingerprint $pgp_key_main | perl -F: -lane 'if ($F[0] eq "fpr") {print $F[9]; exit}')" \
; http://ha.pool.sks-keyservers.net
; FKy7QyQ5Ot41Fdot2k0ekA4UwcwEaHR0cDovL2hhLnBvb2wuc2tzLWtleXNlcnZlcnMubmV0
; ...
; But that's not working with GnuPG. Just junk all of the above.
; Use my pka.py script and drop the keyserver entirely.
; gpg2.1 --export-options export-minimal,export-pka --export 0x0123456789ABCDEF
$ORIGIN _pka.example.org.
; Fingerprint: 0123456789ABCDEF0123456789ABCDEF01234567
; <fred.bloggs@example.org>
;;;kwj7zzgek39st5d5q81hq517e3iuzbr4 CERT 6 0 0 FKy7QyQ5Ot41Fdot2k0ekA4UwcwE
; Fingerprint: 0123456789ABCDEF0123456789ABCDEF01234567
; <fob@example.org>
;;;ajh79yijhx3xmeadhc79zrje7ret3qzr CERT 6 0 0 FKy7QyQ5Ot41Fdot2k0ekA4UwcwE
$ORIGIN example.org.
; }}}PGP-PKA-Records
; }}}PGP-Keys-And-Fingerprints
; Removed localhost entries: cookie stealing etc
;;; ======================================================================
; Sub-domains with email and other services {{{
mailtest MX 10 mx
$ORIGIN mailtest.example.org.
;
d201911._domainkey TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo9xHnjHyhm1weA6FjOqM8LKVsklFt26HXWoe/0XCdmBG4i/UzQ7RiSgWO4kv7anPK6qf6rtL1xYsHufaRXG8yLsZxz+BbUP99eZvxZX78tMg4cGf+yU6uFxulCbOzsMy+8Cc3bbQTtIWYjyWBwnHdRRrCkQxjZ5KAd+x7ZB5qzqg2/eLJ7fCuNsr/xn" "0XTY6XYgug95e3h4CEW3Y+bkG81AMeJmT/hoVTcXvT/Gm6ZOUmx6faQWIHSW7qOR3VS6S75HOuclEUk0gt9r7OQHKl01sXh8g02SHRk8SUMEoNVayqplYZTFFF01Z192m7enmpp+St+HHUIT6jW/CAMCO3wIDAQAB"
d201911e2._domainkey TXT "v=DKIM1; k=ed25519; p=afulDDnhaTzdqKQN0jtWV04eOhAcyBk3NCyVheOf53Y="
;
d202003._domainkey TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs2BTVZaVLvL3qZBPaF7tRR0SdOKe+hjcpQ5fqO48lEuYiyTb6lkn8DPjDK11gTN3au0Bm+y8KC7ITKSJosuJXytxt3wqc61Pwtmb/Cy7GzmOF1AuegydB3/88VbgHT5DZucHrh6+ValZk4Trkx+/1K26Uo+h2KL2n/Ldb1y91ATHujp8DqxAOhiZ7KN" "aS1okNRRB4/14jPufAbeiN8/iBPiY5Hl80KHmpjM+7vvjb5jiecZ1ZrVDj7eTES4pmVh2v1c106mZLieoqDPYaf/HVbCM4E4n1B6kjbboSOpANADIcqXxGJQ7Be7/Sk9f7KwRusrsMHXmBHgm4wPmwGVZ3QIDAQAB"
d202003e2._domainkey TXT "v=DKIM1; k=ed25519; p=iqwH/hhozFdeo1xnuldr8KUi7O7g+DzmC+f0SYMKVDc="
;
_adsp._domainkey TXT "dkim=all"
_dmarc TXT "v=DMARC1; p=none; sp=none; rua=mailto:dmarc-notify@example.org; ruf=mailto:dmarc-notify@example.org; adkim=s"
_report TXT "r=abuse-reports@example.org; rf=ARF; re=postmaster@example.org;"
_smtp._tls TXT "v=TLSRPTv1; rua=mailto:smtp-tls-reports@example.org"
_smtp-tlsrpt TXT "v=TLSRPTv1; rua=mailto:smtp-tls-reports@example.org"
$ORIGIN example.org.
; Stub to show that SKS has been withdrawn; we no longer have email in this
; domain (it was used for PGP exchange with two non-SKS keyservers).
$ORIGIN sks.example.org.
_pgpkey-http._tcp SRV 0 0 0 .
_pgpkey-https._tcp SRV 0 0 0 .
_hkp._tcp SRV 0 0 0 .
$ORIGIN sks-peer.example.org.
_pgpkey-http._tcp SRV 0 0 0 .
_pgpkey-https._tcp SRV 0 0 0 .
_hkp._tcp SRV 0 0 0 .
; This is used for a dynamic DNS entry for my home router; at one point the
; router I was using supported various HTTP-based updates but not Dynamic DNS
; updates, so I switched to HE and have never switched that one back.
$ORIGIN yoyo.example.org.
@ NS ns5.he.net.
@ NS ns4.he.net.
@ NS ns3.he.net.
@ NS ns2.he.net.
@ NS ns1.he.net.
$ORIGIN example.org.
; khard: kubernetes the hard way, Google, `xyz-2` project
; gcloud dns managed-zones create khard --description="Kubernetes The Hard Way HD2" --dns-name="khard.example.org."
; gcloud dns managed-zones describe khard
khard IN NS ns-cloud-d1.googledomains.com.
khard IN NS ns-cloud-d2.googledomains.com.
khard IN NS ns-cloud-d3.googledomains.com.
khard IN NS ns-cloud-d4.googledomains.com.
;;;khard IN DS 15247 8 2 C7CAF8A6EFF0E6E7E811D68CDD87AD2EC135CB501A959FACBA3BC13F93F59864
; Sub-domains with email and other services }}}
;;; ======================================================================
; Stubs to reject email to some hosts {{{
; Hosts which should not appear as senders but are abused by spammers because
; of parsing message-id headers:
realhost MX 0 .
realhost TXT "v=spf1 -all"
_25._tcp.realhost TLSA 03 00 00 0000000000000000000000000000000000000000000000000000000000000000
; Stubs to reject email to some hosts }}}
;;; ======================================================================
; Domain verifications for some tools {{{
; <https://help.github.com/en/articles/verifying-your-organizations-domain>
; "Optionally, once the "Verified" badge is visible on your organization's
; profile page, you can delete the TXT entry from the DNS record at your domain
; hosting service."
;_github-challenge-ExampleOrg TXT "" ; dropped value when commented out
; <https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-validate-dns.html>
; "ACM automatically renews your certificate for as long as the certificate is
; in use and the CNAME record that ACM created for you remains in place in your
; DNS database. You can stop automatic renewal by removing the certificate from
; the AWS service with which it is associated or by deleting the CNAME record."
_fedcba9876543210fedcba9876543210.go.example.org. CNAME _45678901234abcdef45678901234abcd.ggedgsdned.acm-validations.aws.
; -- added 2019-10-09; leave in place, no scheduled removal.
; Google Webmaster
; added 2020-01-26 login fred@example.net
; to allow usage in oauth consent screens.
; Must be left in place.
opqrstuvwxyz CNAME gv-abcdefghijklmn.dv.googlehosted.com.
; postmaster.google.com (CNAME alternative to TXT on top-level domain):
zyxwvutsrqpo CNAME gv-nmlkjihgfedcba.dv.googlehosted.com.
; Bing (I didn't record the policy back when I added this)
0123456789abcdef0123456789abcdef CNAME verify.bing.com.
; Domain verifications for some tools }}}
; vim: set filetype=bindzone foldmethod=marker :
Reference in a new issue Copy permalink