4 ms·
Does anyone know of a tool that guides you with making DNS changes? Before starting it would analyze the current settings (SOA, parent/child NS, DS, DNSKEY, RRS
by mjl- 3y ago
Does anyone know of a tool that guides you with making DNS changes? Before starting it would analyze the current settings (SOA, parent/child NS, DS, DNSKEY, RRSIG, etc and their TTLs), possibly suggest reducing some TTLs, show the when you need to make which changes. Then checking along the way for each step if the changes have propagated and letting you continue with the next step when it is safe. Could be useful for DNSSEC changes, but also just changing name servers.
I moved domains to new name servers last week. I took the poor-man's approach of disabling DNSSEC during the migration. I made a step-by-step plan, verifying propagation along the way with dig. Still made one mistake, where I thought I had reduced the NS TTL in a child zone before migrating, but hadn't (it was still 2 days instead of 1 hour). An automated check would have caught it.
I think such a tool could also have shown this KSK rollover required a longer wait than the procedure had.
- mcesch 3y agoI only know of proprietary tooling for this sort of thing. I'd imagine it'd be tough to sell as a product or service so it'd probably have to be someones labor of love.
- teddyh 3y agoFor moving DNSSEC-signed domains, there’s MUSIC: <https://github.com/DNSSEC-Provisioning/music https://github.com/DNSSEC-Provisioning/music>
- tecleandor 3y agoI would probably build something over OctoDNS, the IAC tool I use at work and home to update and migrate domains and its records...