starred/hickory-dns

Fork 0

mirror of https://github.com/hickory-dns/hickory-dns.git synced 2026-04-25 11:15:54 +03:00

[GH-ISSUE #2822] tsig for dynamic dns updates #1067

New issue

Closed

opened 2026-03-16 01:30:40 +03:00 by kerem · 5 comments

kerem commented

2026-03-16 01:30:40 +03:00

Owner

Originally created by @DirectXMan12 on GitHub (Mar 3, 2025).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2822

Context:

i use kea ¹ for dhcp. per kea's docs, it supports dynamic updates, but only supports tsig for signing, not dnssec/sig0.

on the flip side, hickory supports dnssec, but no tsig, for dynamic updates, which means the two can't talk to each other (since hickory also won't do unsigned updates, which is reasonable).

Goal:

hickory should be able to receive dynamic updates from kea

is there a specific reason for not having tsig dynamic updates (beyond "lots of things to implement, not so much time")?

Alternatives Considered:

getting dnssec/sig0 support into kea -- this seems... more frustrating at first glance (big c codebases are not my favorite), and since kea's dynamic dns updates are aimed at "dhcp server running alongside internal dns server", it seems like tsig isn't terrible at first glance for that usecase.
patching kea to allow unsigned updates on a configuration option -- not great -- means anything with access to the dns server can do updates.

the new-ish replacement for isc's deprecated dhcp server ↩︎

Originally created by @DirectXMan12 on GitHub (Mar 3, 2025). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2822 **Context**: i use [kea](https://www.isc.org/kea/) [^1] for dhcp. per [kea's docs](https://kea.readthedocs.io/en/kea-2.6.1/arm/ddns.html#tsig-key-list), it supports dynamic updates, but only supports tsig for signing, not dnssec/sig0. on the flip side, hickory supports dnssec, but no tsig, for dynamic updates, which means the two can't talk to each other (since hickory also won't do unsigned updates, which is reasonable). **Goal**: hickory should be able to receive dynamic updates from kea is there a specific reason for not having tsig dynamic updates (beyond "lots of things to implement, not so much time")? **Alternatives Considered**: - getting dnssec/sig0 support into kea -- this seems... more frustrating at first glance (big c codebases are not my favorite), and since kea's dynamic dns updates are aimed at "dhcp server running alongside internal dns server", it seems like tsig isn't terrible at first glance for that usecase. - patching kea to allow unsigned updates on a configuration option -- not great -- means anything with access to the dns server can do updates. [^1]: the new-ish replacement for isc's deprecated dhcp server

kerem closed this issue

2026-03-16 01:30:45 +03:00

kerem commented

2026-03-16 01:30:51 +03:00

Author

Owner

@DirectXMan12 commented on GitHub (Mar 3, 2025):

(if it's just "not enough time" or "not enough demand", i miiight take a stab at implementing it -- it seems like the basics of tsig stuff is there from previous tsig client work, but i haven't dug in too much detail)

@DirectXMan12 commented on GitHub (Mar 3, 2025): (if it's just "not enough time" or "not enough demand", i miiight take a stab at implementing it -- it seems like the basics of tsig stuff is there from previous tsig client work, but i haven't dug in too much detail)

kerem commented

2026-03-16 01:30:56 +03:00

Author

Owner

@djc commented on GitHub (Mar 3, 2025):

We have a Tsigner, does that not address your use case? Happy to review contributions in this area!

@djc commented on GitHub (Mar 3, 2025): We have a `Tsigner`, does that not address your use case? Happy to review contributions in this area!

kerem commented

2026-03-16 01:31:01 +03:00

Author

Owner

@DirectXMan12 commented on GitHub (Mar 4, 2025):

We have a Tsigner, does that not address your use case?
i noticed Tsigner in the codebase, but afaict it wasn't actually plumbed through into the hickory-dns binary.

i'll take a shot a plumbing it through.

Happy to review contributions in this area!

yay, cool, i'll try and take a stab at plumbing things through

@DirectXMan12 commented on GitHub (Mar 4, 2025): > We have a `Tsigner`, does that not address your use case? i noticed `Tsigner` in the codebase, but afaict it wasn't actually plumbed through into the `hickory-dns` binary. i'll take a shot a plumbing it through. > Happy to review contributions in this area! yay, cool, i'll try and take a stab at plumbing things through

kerem commented

2026-03-16 01:31:06 +03:00

Author

Owner

@bluejekyll commented on GitHub (Mar 4, 2025):

We might just need better documentation...

@bluejekyll commented on GitHub (Mar 4, 2025): We might just need better documentation...

kerem commented

2026-03-16 01:31:11 +03:00

Author

Owner

@cpu commented on GitHub (May 6, 2025):