otp icon indicating copy to clipboard operation
otp copied to clipboard

Adding DNSSEC-related RRs into `inet_res` and `inet_dns`

Open antranigv opened this issue 6 months ago • 2 comments

In the modern world, DNSSEC is everywhere, however, sometimes people don't implement it on their domain, which is why I was trying to create an application, where I pass it a domain and it checks for the ad flag, as well as for DNSSEC-related RR records, such as RRSIG, DS and DNSKEY.

Turns out that Erlang/OTP's inet_res does get the RRSIG records if dnssec_ok is set to true and edns is set to 0 inside of res_option(), however, the ad flag is not parsed and the RRSIG records are not recognized. all I see is type: 46.

Additionally, There is no way to send a query for the DS and DNSKEY resource records.

In an ideal world, all I need is the ad flag to be parsed (so I can make sure the DNSSEC'd response is validated by the resolver) and that the RRSIG, DS and DNSKEYs are accepted by OTP.

I'd like to implement this myself, but opening the ticket here because missed couple of things when I tried to do this :) If you can guide, I'll send a PR directly. I also wanted to confirm that I'm on the right path for adding these features.

Where are the DNS headers defined? I missed that part. There are other DNS RR types, should they be added as well? Such as SSHFP.

Thank you Erlang/OTP team!

antranigv avatar Aug 16 '24 07:08 antranigv