[GH-ISSUE #68] Enable/disable DNSSEC

kerem commented

2026-02-26 10:35:47 +03:00

Owner

Originally created by @joachimtingvold on GitHub (Jul 2, 2016).
Original GitHub issue: https://github.com/PowerDNS-Admin/PowerDNS-Admin/issues/68

Originally assigned to: @ivanfilippov on GitHub.

Hi,

Slightly relevant to #2 -- is PowerDNS-Admin supposed to automatically detect if a zone is DNSSEC-enabled?

Currently I have a zone that I have DNSSEC-enabled (via the proper PowerDNS utilities), and the different keys are present. The domain is still listed as "Disabled" within PowerDNS-Admin. However, clicking the "Disabled"-button, it shows the relevant DNSSEC-information.

I looked at the code, and I can't find anywhere where the dnssec option would be set to true. The only place I could find, was in Domain.update(), but since there are no place to set true/false within the GUI, this option is never set (regardless if Domain.get_domain_dnssec() is called when clicking on the "Disabled" button).

Originally created by @joachimtingvold on GitHub (Jul 2, 2016). Original GitHub issue: https://github.com/PowerDNS-Admin/PowerDNS-Admin/issues/68 Originally assigned to: @ivanfilippov on GitHub. Hi, Slightly relevant to #2 -- is PowerDNS-Admin supposed to automatically detect if a zone is DNSSEC-enabled? Currently I have a zone that I have DNSSEC-enabled (via the proper PowerDNS utilities), and the different keys are present. The domain is still listed as "Disabled" within PowerDNS-Admin. However, clicking the "Disabled"-button, it shows the relevant DNSSEC-information. I looked at the code, and I can't find anywhere where the `dnssec` option would be set to `true`. The only place I could find, was in `Domain.update()`, but since there are no place to set true/false within the GUI, this option is never set (regardless if `Domain.get_domain_dnssec()` is called when clicking on the "Disabled" button).

kerem closed this issue

2026-02-26 10:35:47 +03:00

kerem commented

2026-02-26 10:35:48 +03:00

Author

Owner

@joachimtingvold commented on GitHub (Jul 2, 2016):

Another thing; the "Enabled"-button (when dnssec = true) should probably have a green (or green-ish) background (and not the grey it currently has).

@joachimtingvold commented on GitHub (Jul 2, 2016): Another thing; the "Enabled"-button (when `dnssec = true`) should probably have a green (or green-ish) background (and not the grey it currently has).

kerem commented

2026-02-26 10:35:48 +03:00

Author

Owner

@TacoScheltema commented on GitHub (Jul 3, 2016):

I totally agree with the green background for the dnssec button. I would also prefer if the width of the enabled button is the same as the disabled button, I think that would look better in the layout.

@TacoScheltema commented on GitHub (Jul 3, 2016): I totally agree with the green background for the dnssec button. I would also prefer if the width of the enabled button is the same as the disabled button, I think that would look better in the layout.

kerem commented

2026-02-26 10:35:48 +03:00

Author

Owner

@ivanfilippov commented on GitHub (Jul 3, 2016):

@jallakim I've replicated your issue, I'll look into it.

@jallakim @TacoScheltema The button should be green, that was something I missed during the migration from the old template into the new one. I've made the fix and I'll push it alongside the rest of the fix for the problem @jallakim described.

@ivanfilippov commented on GitHub (Jul 3, 2016): @jallakim I've replicated your issue, I'll look into it. @jallakim @TacoScheltema The button should be green, that was something I missed during the migration from the old template into the new one. I've made the fix and I'll push it alongside the rest of the fix for the problem @jallakim described.

kerem commented

2026-02-26 10:35:48 +03:00

Author

Owner

@ivanfilippov commented on GitHub (Jul 3, 2016):

@jallakim I spoke too soon, I replicated an issue but not your specific issue. It looks like there is a delay between modifying the domain via pdnsutil and the pdns API showing the change (the delay is somewhere between 1 and 5 seconds, and its randomness makes me think there is a rolling timer that updates the data after a change with pdnsutil), see the below log. I've bolded the times I ran the commands to show the time difference and where pdnsutil shows that DNSSEC was enabled, and where the API shows that it's not. The pdns database is updates instantly so it seems like it's only an API delay.:

powerdns-dev auth-4.0.0-alpha3 # date && pdns/pdnsutil --config-dir=. secure-zone dnssec.test
Sun Jul  3 13:21:03 MDT 2016
Securing zone with default key size
Adding CSK (257) with algorithm ecdsa256
Zone dnssec.test. secured
Adding NSEC ordering information
powerdns-dev auth-4.0.0-alpha3 # date && curl -s -H 'X-API-Key: 1234567890' http://127.0.0.1:2400/api/v1/servers/localhost/zones/dnssec.test | jq .
Sun Jul  3 13:21:07 MDT 2016
{
  "account": "",
  "dnssec": false,
  "id": "dnssec.test.",
  "kind": "Native",
  "last_check": 0,
  "masters": [],
  "name": "dnssec.test.",
  "notified_serial": 0,
  "rrsets": [
    {
      "comments": [],
      "name": "dnssec.test.",
      "records": [
        {
          "content": "a.misconfigured.powerdns.server. hostmaster.dnssec.test. 2016070301 10800 3600 604800 3600",
          "disabled": false
        }
      ],
      "ttl": 3600,
      "type": "SOA"
    }
  ],
  "serial": 2016070301,
  "soa_edit": "",
  "soa_edit_api": "DEFAULT",
  "url": "api/v1/servers/localhost/zones/dnssec.test."
}

@jallakim Are you sure your button still says Disabled when the domain has DNSSEC and it's not just gray?

I've fixed the color and width issue and submitted PR #71 for them.

@ivanfilippov commented on GitHub (Jul 3, 2016): @jallakim I spoke too soon, I replicated an issue but not your specific issue. It looks like there is a delay between modifying the domain via `pdnsutil` and the pdns API showing the change (the delay is somewhere between 1 and 5 seconds, and its randomness makes me think there is a rolling timer that updates the data after a change with `pdnsutil`), see the below log. I've bolded the times I ran the commands to show the time difference and where `pdnsutil` shows that DNSSEC was enabled, and where the API shows that it's not. The pdns database is updates instantly so it seems like it's only an API delay.: <pre> powerdns-dev auth-4.0.0-alpha3 # date && pdns/pdnsutil --config-dir=. secure-zone dnssec.test Sun Jul 3 13:21:03 MDT 2016 Securing zone with default key size Adding CSK (257) with algorithm ecdsa256 Zone dnssec.test. secured Adding NSEC ordering information powerdns-dev auth-4.0.0-alpha3 # date && curl -s -H 'X-API-Key: 1234567890' http://127.0.0.1:2400/api/v1/servers/localhost/zones/dnssec.test | jq . Sun Jul 3 13:21:07 MDT 2016 { "account": "", "dnssec": false, "id": "dnssec.test.", "kind": "Native", "last_check": 0, "masters": [], "name": "dnssec.test.", "notified_serial": 0, "rrsets": [ { "comments": [], "name": "dnssec.test.", "records": [ { "content": "a.misconfigured.powerdns.server. hostmaster.dnssec.test. 2016070301 10800 3600 604800 3600", "disabled": false } ], "ttl": 3600, "type": "SOA" } ], "serial": 2016070301, "soa_edit": "", "soa_edit_api": "DEFAULT", "url": "api/v1/servers/localhost/zones/dnssec.test." } </pre> @jallakim Are you sure your button still says Disabled when the domain has DNSSEC and it's not just gray? I've fixed the color and width issue and submitted PR #71 for them.

kerem commented

2026-02-26 10:35:48 +03:00

Author

Owner

@joachimtingvold commented on GitHub (Jul 4, 2016):

@ngoduykhanh, this issue is not fixed. I'll look into it later today with more details/answer to @ivanfilippov's comment.

@joachimtingvold commented on GitHub (Jul 4, 2016): @ngoduykhanh, this issue is not fixed. I'll look into it later today with more details/answer to @ivanfilippov's comment.

kerem commented

2026-02-26 10:35:48 +03:00

Author

Owner

@joachimtingvold commented on GitHub (Jul 4, 2016):

The width needs to be changed;

I'll look at the other issue later.

@joachimtingvold commented on GitHub (Jul 4, 2016): The width needs to be changed; ![DNSSEC button width](http://files.jocke.no/b/dump_2016-07-04_11.59.42.png) I'll look at the other issue later.

kerem commented

2026-02-26 10:35:48 +03:00

Author

Owner

@joachimtingvold commented on GitHub (Jul 4, 2016):

@ivanfilippov, tested it now.

Created a new domain within PowerDNS-Admin. Set NS + A-records, and pushed/updated (so that it would propagate throughout to the slaves/whatnot). The DNSSEC-button is grey, and no DNSSEC-info is displayed.

Then made the DNSSEC-keys;

root@authdns-master:~# pdnsutil show-zone example.com
This is a Master zone
Last SOA serial number we notified: 2016070403 == 2016070403 (serial in the database)
Zone is not actively secured
Metadata items: 
    SOA-EDIT-API    INCEPTION-INCREMENT
No keys for zone 'example.com.'.
root@authdns-master:~# pdnsutil secure-zone example.com
Securing zone with default key size
Adding CSK (257) with algorithm ecdsa256
Zone example.com. secured
Adding NSEC ordering information 
root@authdns-master:~# pdnsutil show-zone example.com
This is a Master zone
Last SOA serial number we notified: 2016070403 == 2016070403 (serial in the database)
Metadata items: 
    SOA-EDIT-API    INCEPTION-INCREMENT
Zone has NSEC semantics
keys: 
ID = 14 (CSK), flags = 257, tag = 5636, algo = 13, bits = 256     Active ( ECDSAP256SHA256 ) 
CSK DNSKEY = example.com. IN DNSKEY <snip> 3 13 <snip> ; ( ECDSAP256SHA256 )
DS = example.com. IN DS 5636 13 1 5abce09474069403941868dccfc643ca7ea394cb ; ( SHA1 digest )
DS = example.com. IN DS 5636 13 2 b48181edb3e96fca8667444a440fac8139a22b150c5ec30013bbf81b704589df ; ( SHA256 digest )
DS = example.com. IN DS 5636 13 3 a6d277387b68b03dab04c628c1a0891f732f0444062fba2bf134ab965a2f3087 ; ( GOST R 34.11-94 digest )
DS = example.com. IN DS 5636 13 4 1fa85018eafbc61b0bb53e1342e66cb01774270194b26d7eb44df59cd6c0daeba3151d3f0109e5e3c052a270c9924b9e ; ( SHA-384 digest )

The domain is still listed as "Disabled" in the DNSSEC column. Updating the zone does not make any difference. The DNSSEC-information is shown, but dnssec is never set to true. And as mentioned; checking the code, I can't find any place where dnssec would be set to true.

Also, the buttons needs to be wider, as shown in my previous comment (-:

@joachimtingvold commented on GitHub (Jul 4, 2016): @ivanfilippov, tested it now. - Created a new domain within PowerDNS-Admin. Set NS + A-records, and pushed/updated (so that it would propagate throughout to the slaves/whatnot). The DNSSEC-button is grey, and no DNSSEC-info is displayed. ![Updated domain](http://files.jocke.no/b/dump_2016-07-04_13.32.16.png) ![No DNSSEC](http://files.jocke.no/b/dump_2016-07-04_13.32.28.png) - Then made the DNSSEC-keys; ``` root@authdns-master:~# pdnsutil show-zone example.com This is a Master zone Last SOA serial number we notified: 2016070403 == 2016070403 (serial in the database) Zone is not actively secured Metadata items: SOA-EDIT-API INCEPTION-INCREMENT No keys for zone 'example.com.'. root@authdns-master:~# pdnsutil secure-zone example.com Securing zone with default key size Adding CSK (257) with algorithm ecdsa256 Zone example.com. secured Adding NSEC ordering information root@authdns-master:~# pdnsutil show-zone example.com This is a Master zone Last SOA serial number we notified: 2016070403 == 2016070403 (serial in the database) Metadata items: SOA-EDIT-API INCEPTION-INCREMENT Zone has NSEC semantics keys: ID = 14 (CSK), flags = 257, tag = 5636, algo = 13, bits = 256 Active ( ECDSAP256SHA256 ) CSK DNSKEY = example.com. IN DNSKEY <snip> 3 13 <snip> ; ( ECDSAP256SHA256 ) DS = example.com. IN DS 5636 13 1 5abce09474069403941868dccfc643ca7ea394cb ; ( SHA1 digest ) DS = example.com. IN DS 5636 13 2 b48181edb3e96fca8667444a440fac8139a22b150c5ec30013bbf81b704589df ; ( SHA256 digest ) DS = example.com. IN DS 5636 13 3 a6d277387b68b03dab04c628c1a0891f732f0444062fba2bf134ab965a2f3087 ; ( GOST R 34.11-94 digest ) DS = example.com. IN DS 5636 13 4 1fa85018eafbc61b0bb53e1342e66cb01774270194b26d7eb44df59cd6c0daeba3151d3f0109e5e3c052a270c9924b9e ; ( SHA-384 digest ) ``` - The domain is still listed as "Disabled" in the DNSSEC column. Updating the zone does not make any difference. The DNSSEC-information is shown, but `dnssec` is never set to `true`. And as mentioned; checking the code, I can't find any place where `dnssec` would be set to `true`. ![Disabled](http://files.jocke.no/b/dump_2016-07-04_13.33.24.png) ![DNSSEC](http://files.jocke.no/b/dump_2016-07-04_13.33.37.png) - Also, the buttons needs to be wider, as shown in my previous comment (-:

kerem commented

2026-02-26 10:35:48 +03:00

Author

Owner

@ngoduykhanh commented on GitHub (Jul 4, 2016):

@jallakim : I guess you are using PostgreSQL as DB backend for PowerDNS-Admin, right?.
@ivanfilippov : The issue is the dnssec value isn't reloaded when we run domain.update(). It is same issue with #61 which is related to how we store the Boolean value in the PostgreSQL.

Fixed in 0bd488b9bc

@ngoduykhanh commented on GitHub (Jul 4, 2016): @jallakim : I guess you are using PostgreSQL as DB backend for PowerDNS-Admin, right?. @ivanfilippov : The issue is the `dnssec` value isn't reloaded when we run `domain.update()`. It is same issue with #61 which is related to how we store the Boolean value in the PostgreSQL. Fixed in 0bd488b9bc69fc8ee78a74ddceea61ebca0b4852

kerem commented

2026-02-26 10:35:48 +03:00

Author

Owner

@ivanfilippov commented on GitHub (Jul 4, 2016):

@ngoduykhanh Nice find!

While you're in there, can you also fix the width of the buttons themselves that I tried here: github.com/ngoduykhanh/PowerDNS-Admin@d0c40c09e5

I'd say get rid of the col-md-6 and just set the width with a width="10% or something similar (like we do for the edit and delete buttons in the domain.html template)

@ivanfilippov commented on GitHub (Jul 4, 2016): @ngoduykhanh Nice find! While you're in there, can you also fix the width of the buttons themselves that I tried here: https://github.com/ngoduykhanh/PowerDNS-Admin/commit/d0c40c09e521f588b272c48cacd797c384079dc8 I'd say get rid of the `col-md-6` and just set the width with a `width="10%` or something similar (like we do for the edit and delete buttons in the domain.html template)

kerem commented

2026-02-26 10:35:48 +03:00

Author

Owner

@joachimtingvold commented on GitHub (Jul 4, 2016):

@ngoduykhanh, correct, I'm using PostgreSQL as backend.

@joachimtingvold commented on GitHub (Jul 4, 2016): @ngoduykhanh, correct, I'm using PostgreSQL as backend.

kerem commented

2026-02-26 10:35:48 +03:00

Author

Owner

@ngoduykhanh commented on GitHub (Jul 4, 2016):

The width of DNSSEC column can be changed when the use resize their windows. I can't make sure 10% or something similar can fit the text so I set it to 100% width of the column in 7a0327d290 for the quick fix. It looks good to me, let me know if you don't like it :D

@ngoduykhanh commented on GitHub (Jul 4, 2016): The width of DNSSEC column can be changed when the use resize their windows. I can't make sure 10% or something similar can fit the text so I set it to 100% width of the column in 7a0327d29000547f78d412cc47e8c3a1b8ab8309 for the quick fix. It looks good to me, let me know if you don't like it :D <img width="1015" alt="screen shot 2016-07-04 at 10 41 07 pm" src="https://cloud.githubusercontent.com/assets/6447444/16565652/fc18c644-4238-11e6-9695-d222d15fb8f2.png">

kerem commented

2026-02-26 10:35:48 +03:00

Author

Owner

@joachimtingvold commented on GitHub (Jul 4, 2016):

Works like a charm now. Thanks!

The 100% width is fine by me. Maybe a bit "intrusive" (due to it's size), but at least much better than "Enabled" and "Disabled" both being gray (-:

@joachimtingvold commented on GitHub (Jul 4, 2016): Works like a charm now. Thanks! The 100% width is fine by me. Maybe a bit "intrusive" (due to it's size), but at least much better than "Enabled" and "Disabled" both being gray (-:

kerem commented

2026-02-26 10:35:48 +03:00

Author

Owner

@liudonghua123 commented on GitHub (Apr 30, 2024):

I use pschiffe/pdns-mysql docker image which I need to config PDNS_gmysql_dnssec=yes env to enable DNSSEC, see also https://github.com/pschiffe/docker-pdns/issues/82.

@liudonghua123 commented on GitHub (Apr 30, 2024): I use [pschiffe/pdns-mysql](https://hub.docker.com/r/pschiffe/pdns-mysql/) docker image which I need to config `PDNS_gmysql_dnssec=yes` env to enable DNSSEC, see also https://github.com/pschiffe/docker-pdns/issues/82.

Rows
Columns

[GH-ISSUE #68] Enable/disable DNSSEC #45