<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Alun,<div class=""><br class=""><div><blockquote type="cite" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: AvenirNext-Regular; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">We currently edit records by way of PowerAdmin, which updates the master database directly and so “PowerDNS Auth A” instance is not actually used or interacted with, normally. Zone/record updates are replicated to the “edge” Auth servers (B and C) via MySQL replication. We would like to enable DNSSec on a few of our domains, at least as a proof of concept. A few questions…<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I assume I need to enable gmysql-dnssec on ALL PowerDNS Auth instances (A,B and C)?<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Will PowerDNS commands to enable DNSSec signing of a zone need executed on “PowerDNS Auth A” ONLY (which will add the relevant records to the database and replicate them to B and C)?<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Given that PowerAdmin talks directly to the database, any record changes here likely to cause a problem with these signed domains?<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Should I look at a newer GUI that implements the DNSSec commands and interacts with PowerDNS API instead?</div></div></blockquote><div><br class=""></div><div>This is a setup we’ve built a few times for customers of ours, with these exact same components (we usually do add dnsdist for easier DDoS and abuse mitigation).</div><div><br class=""></div><div>Unless you have a large number of queries against your nameservers, I would recommend to do “online signing” in PowerDNS, as described in <a href="https://docs.powerdns.com/authoritative/dnssec/modes-of-operation.html#online-signing" class="">https://docs.powerdns.com/authoritative/dnssec/modes-of-operation.html#online-signing</a>. In that mode, only the keys is stored in the database, and thus you’d need to enable this feature on each of your PowerDNS auth servers.</div><div><br class=""></div><div>Once you configure all instances to handle DNSSEC, there’s nothing extra to configure: the key info is stored in the database, the flags that enable dnssec are stored in the database, so as long as your replication works, you’re good!</div><div><br class=""></div><div>While you could continue to work directly in the database, we do recommend people to use the API. When enabling DNSSEC, it’s very import to “rectify” the database structure after all changes. Using the API, this becomes much easier than fiddling with the DB directly. PowerAdmin can be configured to talk directly to the API.</div><div><br class=""></div><div>As a precaution, I would enable the API only on the min PowerDNS server, and would grant the PowerDNS “slaves” read-only access to their own databases, to prevent accidental changes in these nodes.</div><div><br class=""></div><div>Hope this helps!</div><div><br class=""></div><div>Frank Louwers</div><div>Certified PowerDNS Consultant @ Kiwazo</div><div><br class=""></div><div><br class=""></div><blockquote type="cite" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: AvenirNext-Regular; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Thanks in advance…<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Regards,<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Alun.<span style="font-size: 13.5pt; font-family: "Times New Roman", serif; color: rgb(72, 72, 72);" class=""><o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 13.5pt; font-family: "Times New Roman", serif; color: rgb(72, 72, 72);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 13.5pt; font-family: "Times New Roman", serif; color: rgb(72, 72, 72);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 13.5pt; font-family: "Times New Roman", serif; color: rgb(72, 72, 72);" class=""><br class=""><br class=""></span><span style="font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><a href="http://www.tibus.com/?utm_source=signature&utm_medium=email" style="color: rgb(149, 79, 114); text-decoration: underline;" class=""><span id="cid:image001.png@01D50BD6.229FE9F0"><image001.png></span></a><span id="cid:image002.png@01D50BD6.229FE9F0"><image002.png></span><b class=""><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(72, 72, 72);" class="">Alun James<o:p class=""></o:p></span></b></div><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 11pt; font-family: Calibri, sans-serif;"><b class=""><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(72, 72, 72);" class="">Senior Systems Engineer<o:p class=""></o:p></span></b></p><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(72, 72, 72);" class="">T: +44 (0) 28 9033 1122<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(72, 72, 72);" class="">E: <a href="mailto:ajames@tibus.com" title="Email" style="color: rgb(149, 79, 114); text-decoration: underline;" class=""><span style="color: rgb(72, 72, 72);" class="">ajames@tibus.com</span></a><o:p class=""></o:p></span></div><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(72, 72, 72);" class="">W: <a href="http://www.tibus.com/?utm_source=signature&utm_medium=email" title="Website" style="color: rgb(149, 79, 114); text-decoration: underline;" class=""><span style="color: rgb(72, 72, 72);" class="">www.tibus.com</span></a><o:p class=""></o:p></span></p><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><a href="https://www.facebook.com/tibusDigital" title="Tibus Facebook" style="color: rgb(149, 79, 114); text-decoration: underline;" class=""><span style="font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(72, 72, 72); text-decoration: none;" class=""><span id="cid:image003.png@01D50BD6.229FE9F0"><image003.png></span></span></a><span style="font-size: 12pt; font-family: "Times New Roman", serif;" class=""> <span class="Apple-converted-space"> </span></span><a href="https://twitter.com/tibus" title="Tibus Twitter" style="color: rgb(149, 79, 114); text-decoration: underline;" class=""><span style="font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(72, 72, 72); text-decoration: none;" class=""><span id="cid:image004.png@01D50BD6.229FE9F0"><image004.png></span></span></a><span style="font-size: 12pt; font-family: "Times New Roman", serif;" class=""> <span class="Apple-converted-space"> </span></span><a href="https://www.linkedin.com/company/tibus" title="Tibus LinkedIn" style="color: rgb(149, 79, 114); text-decoration: underline;" class=""><span style="font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(72, 72, 72); text-decoration: none;" class=""><span id="cid:image005.png@01D50BD6.229FE9F0"><image005.png></span></span></a><span style="font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""></o:p></span></div><p class="MsoNormal" style="margin: 9.75pt 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 7.5pt; font-family: Arial, sans-serif; color: rgb(72, 72, 72);" class="">Tibus is a wholly-owned division of Wireless.<o:p class=""></o:p></span></p><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><br style="caret-color: rgb(0, 0, 0); font-family: AvenirNext-Regular; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: AvenirNext-Regular; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: AvenirNext-Regular; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">_______________________________________________</span><br style="caret-color: rgb(0, 0, 0); font-family: AvenirNext-Regular; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: AvenirNext-Regular; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">Pdns-users mailing list</span><br style="caret-color: rgb(0, 0, 0); font-family: AvenirNext-Regular; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><a href="mailto:Pdns-users@mailman.powerdns.com" style="color: rgb(149, 79, 114); text-decoration: underline; font-family: AvenirNext-Regular; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">Pdns-users@mailman.powerdns.com</a><br style="caret-color: rgb(0, 0, 0); font-family: AvenirNext-Regular; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><a href="https://mailman.powerdns.com/mailman/listinfo/pdns-users" style="color: rgb(149, 79, 114); text-decoration: underline; font-family: AvenirNext-Regular; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">https://mailman.powerdns.com/mailman/listinfo/pdns-users</a></blockquote></div><br class=""></div><div class=""></div></body></html>