buffrr

HSD + Knot resolver (with DNSSEC enabled)

Run hsd as a root server only at 127.0.0.2:53 and let knot-resolver do recursion (recommended):

hsd --no-wallet --no-rs --no-sig0 --ns-host 127.0.0.2 --ns-port 53

Add hsd KSK /var/lib/knot-resolver/root.keys

buffrr

Note: ⚠️ this is a draft still needs some work/not 100% tested:

Knot DNS setup

Install knot

LC_ALL=C.UTF-8 add-apt-repository ppa:cz.nic-labs/knot-dns-latest
apt-get update
apt-get install knot

buffrr

Creating a self-signed certificate for example.com (if you already have a certificate you can skip this step):

openssl req -x509 -newkey rsa:4096 -sha256 -days 365 -nodes \
  -keyout cert.key -out cert.crt -extensions ext  -config \
  <(echo "[req]"; 
    echo distinguished_name=req; 
    echo "[ext]";
 echo "keyUsage=critical,digitalSignature,keyEncipherment";

buffrr

This is a proof of concept branch for fixing NSEC proofs in HSD.

Here is some example configurations for running a standalone HSD root server with an external dnssec recursive resolver! You can let bind or external unbound resolver do most of the work for resolving and validating dnssec. HSD will only be responsible for serving the root zone.

Install hsd using the blacklies branch:

git clone https://github.com/buffrr/hsd
cd hsd && git checkout blacklies

buffrr

Keybase proof

I hereby claim:

• I am buffrr on github.
• I am buffrr (https://keybase.io/buffrr) on keybase.
• I have a public key ASD5-DnOfECmyq8VITgfgYxbQNcsqqUG9mgrJCEdkx0YSwo

To claim this, I am signing this object: