Skip to content

Adding check-dns-zone.sh and some #15

Merged
fbrehm merged 11 commits into
masterfrom
develop
May 12, 2026
Merged

Adding check-dns-zone.sh and some #15
fbrehm merged 11 commits into
masterfrom
develop

Conversation

@fbrehm

@fbrehm fbrehm commented May 12, 2026

Copy link
Copy Markdown
Member
  • Adding check script check-dns-zone.sh for checking validity of the SOA of a DNS zone and optional the validity of the DNSSEC RRSIG if the SOA record.
  • Adding three unit test scripts for Python modules.
  • Fixing command line evaluation in update-env.sh

@fbrehm fbrehm requested a review from cruelsmith May 12, 2026 13:08
@fbrehm fbrehm self-assigned this May 12, 2026
@fbrehm fbrehm added bug Something isn't working enhancement New feature or request labels May 12, 2026

@cruelsmith cruelsmith left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Replacing some dependencies with bash / coreutils alternatives.

Still some todo for the awk replacement.

Comment thread check-dns-zone.sh Outdated
Comment thread check-dns-zone.sh Outdated
Comment thread check-dns-zone.sh
cmd+="\"@${SERVER}\" "
fi

cmd+="SOA +nocomments +noadditional +nocmd +noquestion"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Optional alternative but that would need to adjust the content filter.

Suggested change
cmd+="SOA +nocomments +noadditional +nocmd +noquestion"
cmd+="SOA +short +identify"

Comment thread check-dns-zone.sh Outdated

server=$( echo "${response}" | grep -P -i '^;; SERVER:' | sed -e 's/^;; SERVER:[ ][ ]*//i' )

if echo "${response}" | grep -P -q -i "^${ZONE}\\.\\s.*\\ssoa\\s" ; then

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Optional: convert into bash regex matching

Comment thread check-dns-zone.sh Outdated
Comment thread check-dns-zone.sh Outdated
* replace awk by date from coreutils
* using bash for substring and replacement
* fix handling in case of missing rrsig responce
@cruelsmith

Copy link
Copy Markdown
Contributor

Based on https://doc.powerdns.com/authoritative/dnssec/modes-of-operation.html#signatures
We would want to have the following threshold:

  • warning 7d
  • critical 5d

@fbrehm fbrehm merged commit 7ed8dd1 into master May 12, 2026
18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants