hsd.knot-resolver.md

HSD + Knot resolver (with DNSSEC enabled)

Run hsd as a root server only at 127.0.0.2:53 and let knot-resolver do recursion (recommended):

hsd --no-wallet --no-rs --no-sig0 --ns-host 127.0.0.2 --ns-port 53

Add hsd KSK /var/lib/knot-resolver/root.keys

.                       9471    IN      DNSKEY  257 3 13 T9cURJ2M/Mz9q6UsZNY+Ospyvj+Uv+tgrrWkLtPQwgU/Xu5Yk0l02Sn5 ua2xAQfEYIzRO6v5iA+BejMeEwNP4Q==

edit /etc/knot-resolver/kresd.conf

-- Network interface configuration

-- add interfaces you'd like to listen to
net.listen('127.0.0.1', 53, { kind = 'dns' })


-- Load useful modules
modules = {
        'hints > iterate',  -- Load /etc/hosts and allow custom root hints
        'stats',            -- Track internal statistics
        'predict',          -- Prefetch expiring/frequent records
}

-- Unload TA signal
modules.unload('ta_signal_query')
modules.unload('ta_sentinel')

-- Unload root priming module
modules.unload('priming')

-- Override the root hints
-- synth record must match ip you used for hsd root server 127.0.0.2 = _fs0000g._synth. 
-- dig @hsd-root . NS to find correct synth name
hints.root({
  ['_fs0000g._synth.'] = { '127.0.0.2' }
})

-- Load custom trust anchor
trust_anchors.add_file('root.keys', true)