OpenDNSSEC

OpenDNSSEC
Name	OpenDNSSEC
Developer	NLnet Labs, SURFnet, Kirei
Released	2010
Programming language	C, Lua, Python
Operating system	FreeBSD, Linux
Genre	DNSSEC management
License	BSD, ISC

OpenDNSSEC is an open-source software system designed to automate the deployment and management of DNS Security Extensions for authoritative name servers. It integrates with DNS server implementations, Hardware Security Modules, and key management practices promoted by standards bodies and major institutions. The project has intersected with work from prominent organizations and events in the Internet engineering community.

History

OpenDNSSEC originated from collaborative efforts among NLnet Labs, SURFnet, and partners influenced by specifications from the Internet Engineering Task Force and the IETF DNSOP Working Group. Early development was driven by needs identified at meetings such as the IETF meetings and regional Internet registries' operational fora. Funding and organizational support came from grants and programs associated with institutions like the NWO and initiatives promoted by RIPE NCC and APNIC. Major milestones included adoption trials by national registries, presentations at conferences including RIPE Meeting and ICANN sessions, and integration work with vendors showcased at IETF Hackathon events.

Architecture and Components

The architecture combines a signing workflow engine, a policy engine, a database back end, and an interface to cryptographic modules. Core components mirror patterns used by projects such as BIND and Knot DNS while interoperating with standards from the IETF RFCs. A central component manages zone signing and key rollovers; another component acts as a queuing and task scheduler integrating with Hardware Security Module vendors and tooling used by operators at registries like DENIC and Nominet. The persistent store uses relational techniques familiar to administrators of PostgreSQL and SQLite deployments, and orchestration can tie into systems managed by organizations such as Red Hat and Debian.

Key Features

OpenDNSSEC provides automated key generation, zonal signing, key rollover policies, and audit logging. Its policy model reflects recommendations from RFC 5011 and other RFCs authored by participants from institutions like ICANN and the IETF. The tool offers integration points for HSMs compliant with the PKCS#11 API and supports operational patterns used by registrars and registries including AFNIC and Verisign. It produces cryptographic artifacts consumable by authoritative servers such as PowerDNS and Knot DNS and supports provisioning models similar to those used in projects by NLnet and OpenSSL contributors.

Deployment and Operation

Operational deployment commonly involves connecting OpenDNSSEC to existing authoritative ecosystems run by national ccTLD operators like SIDN and commercial operators such as Akamai and Cloudflare for testing. Typical workflows mirror best practices discussed at IETF sessions and regional operator groups like NOG meetings. Administrators often run OpenDNSSEC on platforms maintained by distributions such as Ubuntu, CentOS, and FreeBSD Foundation systems, using configuration management approaches developed in communities around Ansible and Puppet. Monitoring and alerting practices draw on tools used by projects affiliated with Prometheus and Nagios.

Security and Cryptography

The project adheres to cryptographic guidance authored by working groups at IETF and leverages algorithms standardized in RFCs supported by contributors from NIST and academic groups. It interfaces with HSMs and PKI components developed by vendors whose products are used in national infrastructures overseen by bodies like ENISA. Security features include role separation, audit logging, and secure key storage workflows that align with frameworks advocated by ISO and operational guidance from registries such as ICANN's technical reports. Cryptographic operations make use of libraries and implementations with provenance linked to projects like OpenSSL and LibreSSL.

Implementations and Integrations

Implementations have been demonstrated in combination with DNS servers such as BIND, PowerDNS, and Knot DNS, and integrated into registry toolchains used by ccTLD operators like Nominet, EURid, and NIC Mexico. Integration tests and continuous integration practices reflect approaches used by communities around GitLab and GitHub, and packaging has been contributed to distributions maintained by Debian Project and Red Hat. Interoperability efforts have been showcased alongside other security tools found in ecosystems supported by RIPE NCC and operator communities at IETF meetings.

Community and Governance

The project governance has involved contributors from research labs, national registry teams, and companies participating in the broader Internet governance ecosystem including ICANN constituencies and regional registries like APNIC and ARIN. Development discussions frequently occur on mailing lists and at events such as IETF meetings, RIPE Meetings, and operator forums hosted by organizations like ISOC. Funding, stewardship, and maintenance have been shaped by partnerships among entities such as NLnet Foundation and commercial contributors engaging with standards bodies like the IETF.

Category:DNS Category:Internet security