3 ms·

If anyone wants a generic utility for interfacing with various DNS APIs, see lexicon: * https://github.com/AnalogJ/lexicon https://github.com/AnalogJ/lexicon

If anyone wants a generic utility for interfacing with various DNS APIs, see lexicon: * https://github.com/AnalogJ/lexicon https://github.com/AnalogJ/lexicon For CLI and Python. Such a utility is handy if you want to use the dns-01 method for ACME/Let's Encrypt via DNS aliasing: * https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mode https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... * https://news.ycombinator.com/item?id=28256326 https://news.ycombinator.com/item?id=28256326 (2020) Deep dive on how ACME DNS validation works: * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... Some folks have also written 'minimalist' DNS servers for DNS validation (delegate to a sub-domain that you control if your provider does not have an API): * https://github.com/joohoi/acme-dns https://github.com/joohoi/acme-dns

newman314 4y ago
There are also the following: * dnscontrol - https://stackexchange.github.io/dnscontrol/ https://stackexchange.github.io/dnscontrol/ * octodns - https://github.com/octodns/octodns https://github.com/octodns/octodns
haswell 4y ago
These are all great resources, but a bit off topic, no? NextDNS is essentially Pi-hole-as-a-service, and its APIs are not focused on managing DNS in the traditional sense. Instead, they provide visibility into NextDNS's lookup/block analytics, managing settings, etc.
remram 4y ago
It seems that lexicon is handy to use dns-01 instead of DNS aliasing. If you do aliasing, you can serve the DNS challenge from the server you want and that you fully control. You don't need to interface with your registrar, you just add an NS record once (manually). You need lexicon if you want to serve the challenge from your registrar instead, and lexicon is the tool that will allow you to talk to many registrars.
- throw0101a 4y ago
  > It seems that lexicon is handy to use dns-01 instead of DNS aliasing. Say I own example.com, but because it lives on a DNS server that does not have an API, or changes to the company's domain need to go through change control, I cannot easily change it. But I want an ACME/LE cert for foo.example.com, which could be an internal-only service so http-01 is not available. So I can set up a CNAME/alias at _acme-challenge.foo.example.com and point it to (e.g.) foo.example.org. Now I also own example.org, but because it's not the 'main' domain the controls on it are less onerous. So when I request "foo.example.com", it finds the CNAME and heads over to "foo.example.org", where I've update the ACME nonce dynamically. The CNAME setup is a one-time thing, and can go through the 'regular' steps initially, and can then just be left alone. Or, instead of a entire new domain (example.org), I can delegate things to a sub-domain (dnsauth.example.com) as well.
  - remram 4y ago
    As you can see in your own summary, it doesn't require talking with example.com's provider's awkward API, which was my point. Instead you can subvert that and use a DNS you can easily update or even run DNS temporarily from your ACME client, so implementing many APIs (what lexicon does) is not required.
melony 4y ago
What are some use cases for this sort of libraries?

newman314 4y ago

There are also the following: * dnscontrol - https://stackexchange.github.io/dnscontrol/ https://stackexchange.github.io/dnscontrol/ * octodns - https://github.com/octodns/octodns https://github.com/octodns/octodns

haswell 4y ago

These are all great resources, but a bit off topic, no? NextDNS is essentially Pi-hole-as-a-service, and its APIs are not focused on managing DNS in the traditional sense. Instead, they provide visibility into NextDNS's lookup/block analytics, managing settings, etc.

remram 4y ago

It seems that lexicon is handy to use dns-01 instead of DNS aliasing. If you do aliasing, you can serve the DNS challenge from the server you want and that you fully control. You don't need to interface with your registrar, you just add an NS record once (manually). You need lexicon if you want to serve the challenge from your registrar instead, and lexicon is the tool that will allow you to talk to many registrars.

throw0101a 4y ago
> It seems that lexicon is handy to use dns-01 instead of DNS aliasing. Say I own example.com, but because it lives on a DNS server that does not have an API, or changes to the company's domain need to go through change control, I cannot easily change it. But I want an ACME/LE cert for foo.example.com, which could be an internal-only service so http-01 is not available. So I can set up a CNAME/alias at _acme-challenge.foo.example.com and point it to (e.g.) foo.example.org. Now I also own example.org, but because it's not the 'main' domain the controls on it are less onerous. So when I request "foo.example.com", it finds the CNAME and heads over to "foo.example.org", where I've update the ACME nonce dynamically. The CNAME setup is a one-time thing, and can go through the 'regular' steps initially, and can then just be left alone. Or, instead of a entire new domain (example.org), I can delegate things to a sub-domain (dnsauth.example.com) as well.
- remram 4y ago
  As you can see in your own summary, it doesn't require talking with example.com's provider's awkward API, which was my point. Instead you can subvert that and use a DNS you can easily update or even run DNS temporarily from your ACME client, so implementing many APIs (what lexicon does) is not required.

melony 4y ago

What are some use cases for this sort of libraries?