overview-dnssec.sh

#!/usr/bin/env bash
set -euo pipefail
# Script to assist with disabling DNSSEC signing
# Usage:
#   DOMAIN=sparta.kyxap.pro ./$0

type -P dig shuf 2>&1 >/dev/null

DOMAIN="${DOMAIN}."

# looking for all parent records
# records=([0]="sparta.kyxap.pro" [1]="kyxap.pro" [2]="pro")
records=(${DOMAIN%%.})
for s in ${DOMAIN//\./ }
do
  c+="${s}."
  sub=${DOMAIN#${c}}
  records+=(${sub%%.})
done

cmd () {
  local cmd="${@}"
  printf "%s\n" "# > ${cmd[@]}" >&2
  ${cmd[@]}
  echo >&2
  unset cmd
}

p () {
  local msg="${@}"
  printf "# $(tput bold)$(tput setb 4)$(tput setaf 7)%s$(tput sgr0)\n" "${msg[@]}" >&2
  unset msg
}

p Find the current DS TTL.
cmd dig +nostats +nocomments +nocmd +noquestion +noqr DS "${records[@]}"

p Find the maximum NS TTL.
p [parent] Find nameservers.
cmd dig +nostats +nocomments +nocmd +noquestion +noqr NS "${records[-1]}"
ns=($(dig +nostats +nocomments +nocmd +noquestion +noqr +short NS "${records[-1]}"))
rand=$(shuf -i 0-"$((${#ns[@]}-1))" -n1)

p [parent] Find delegation NS record.
cmd dig +nostats +nocomments +nocmd +noquestion +noqr NS @"${ns[${rand}]}" "${records[0]}"

p Find the maximum NS TTL.
p [zone] Find nameservers.
cmd dig +nostats +nocomments +nocmd +noquestion +noqr NS "${records[0]}"
ns=($(dig +nostats +nocomments +nocmd +noquestion +noqr +short NS "${records[0]}"))
rand=$(shuf -i 0-"$((${#ns[@]}-1))" -n1)