DNSSEC Zone Signing Utility

Create a small DNSSEC helper that turns a provided private key into publishable DNSKEY/DS material, signs an authoritative A RRset, and validates the resulting signature. The tests supply a fixed RSASHA256 signing key in PEM form; no key generation is required.

Capabilities

Publish DNSKEY and DS records

• Given a PEM-formatted signing key for signed.example., produce a DNSKEY record with flag 257 and the matching DS digests for SHA-256 and SHA-384 (digest types 2 and 4). The key tag must match the DNSKEY contents and the DS values must match the canonical digest for that DNSKEY. @test

Sign an A RRset

• Using the same key, sign the A RRset for signed.example. with TTL 300 containing 192.0.2.10 and 192.0.2.20, inception 20240101000000Z, and expiration 20250101000000Z. The resulting RRSIG must cover both A records, encode the provided validity window, and verify successfully against the generated DNSKEY. @test

Validate signatures

• Validation returns True for the untouched RRSIG from the signing step, and False if the signature data is altered or if a DNSKEY from a different key tag is supplied. @test

Implementation

@generates

API

from datetime import datetime
from typing import Dict, List, TypedDict

class KeyMaterial(TypedDict):
    dnskey: str  # presentation-format DNSKEY
    ds: List[str]  # presentation-format DS records in the same order as requested digests
    key_tag: int


def load_key(zone: str, private_key_pem: str, algorithm: str, digest_algorithms: List[str]) -> KeyMaterial:
    """Build a DNSKEY with flag 257/protocol 3 for the given algorithm (tests use RSASHA256) and return DS digests for each requested digest algorithm ('SHA-256' and/or 'SHA-384') in the same order."""


def sign_rrset(zone: str, ttl: int, records: List[str], key: KeyMaterial, inception: datetime, expiration: datetime) -> str:
    """Sign the A RRset (one name, multiple values) using the provided key material and validity window, returning an RRSIG string."""


def verify_rrsig(zone: str, ttl: int, records: List[str], rrsig: str, dnskey: str) -> bool:
    """Validate the RRSIG against the RRset and DNSKEY, returning True only when the signature covers the RRset (with canonical ordering) and the current UTC time is inside the signature window."""

Dependencies { .dependencies }

dnspython { .dependency }

Provides DNSSEC-aware DNS record modeling, signing, and validation utilities.