[GH-ISSUE #54] nsedit: pdnssec rectify-zone/rectify-all-zones #30

New issue

Closed

opened 2026-02-28 01:20:37 +03:00 by kerem · 2 comments

kerem commented

2026-02-28 01:20:37 +03:00

Owner

Originally created by @piwats on GitHub (Sep 23, 2015).
Original GitHub issue: https://github.com/tuxis-ie/nsedit/issues/54

When having a zone in NSEC3 mode, adding a record to it without running pdnssec rectify-zone xxx or pdnssec rectify all zones results in NXDOMAIN response.

Is there a way nsedit could run pdnssec to rectify the zone it just "edited"?

Originally created by @piwats on GitHub (Sep 23, 2015). Original GitHub issue: https://github.com/tuxis-ie/nsedit/issues/54 When having a zone in NSEC3 mode, adding a record to it without running pdnssec rectify-zone xxx or pdnssec rectify all zones results in NXDOMAIN response. Is there a way nsedit could run pdnssec to rectify the zone it just "edited"?

kerem closed this issue

2026-02-28 01:20:38 +03:00

kerem commented

2026-02-28 01:20:38 +03:00

Author

Owner

@tuxis-ie commented on GitHub (Sep 23, 2015):

According to https://doc.powerdns.com/md/httpapi/api_spec/#zones, this is not yet implemented. IMHO, pdns should always be responsible for this.

@tuxis-ie commented on GitHub (Sep 23, 2015): According to https://doc.powerdns.com/md/httpapi/api_spec/#zones, this is not yet implemented. IMHO, pdns should always be responsible for this.

kerem commented

2026-02-28 01:20:38 +03:00

Author

Owner

@piwats commented on GitHub (Sep 25, 2015):

I meant, that when you deploy dnssec on pdns

1.) pdnssec secure-zone ZONE
2.) pdnssec set-nsec3 ZONE

after this, each time you add an additional record to the zone, you have to run pdnssec rectify-zone ZONE in order to get answers of the new records. If not, you'll get an NXDOMAIN response.

I'm not sure that this is an upstream bug.

But still, it would be nice to see, if nsedit could simply run pdnssec rectify-zone ZONE, so one doesn't need to run it manually.

@piwats commented on GitHub (Sep 25, 2015): I meant, that when you deploy dnssec on pdns 1.) pdnssec secure-zone ZONE 2.) pdnssec set-nsec3 ZONE after this, each time you add an additional record to the zone, you have to run pdnssec rectify-zone ZONE in order to get answers of the new records. If not, you'll get an NXDOMAIN response. I'm not sure that this is an upstream bug. But still, it would be nice to see, if nsedit could simply run pdnssec rectify-zone ZONE, so one doesn't need to run it manually.

kerem referenced this issue

2026-02-28 01:21:11 +03:00

[PR #30] [MERGED] Get the nameservers from the template, if any. If we don't have nameserv... #142