Authoritative DNS
Built in 🦀 Rust

Database Schema

copy-- dns_records.sql (at repository root)
CREATE TABLE IF NOT EXISTS dns_records (
  domain      TEXT    NOT NULL,
  record_type TEXT    NOT NULL,
  value       TEXT    NOT NULL,
  ttl         INTEGER DEFAULT 3600,
  PRIMARY KEY (domain, record_type, value)
) WITHOUT ROWID;

Sample Records

copyINSERT OR REPLACE INTO dns_records VALUES
('example.com', 'A',   '203.0.113.10',           3600),
('example.com', 'AAAA','2001:db8::1',            3600),
('example.com', 'MX',  '10 mail.example.com',    3600),
('example.com', 'MX',  '20 backup.example.com',  3600),
('example.com', 'NS',  'ns1.example.com',        86400),
('example.com', 'NS',  'ns2.example.com',        86400),
('example.com', 'SOA', 'ns1.example.com hostmaster.example.com 2024010101 10800 3600 604800 86400', 86400),
('example.com', 'TXT', '"v=spf1 a mx ~all"',     3600),
('www.example.com','A','203.0.113.10',           3600);

SQL Operations

copy-- Open the database
sqlite3 /var/nx9-dns-server/dns.db

-- View all records
SELECT * FROM dns_records;

-- Filter by domain
SELECT * FROM dns_records
WHERE domain = 'example.com';

-- Update a record
INSERT OR REPLACE INTO dns_records VALUES
('www.example.com', 'A', '203.0.113.11', 3600);

-- Delete a record
DELETE FROM dns_records
WHERE domain='old.example.com'
AND record_type='A';

SOA & Best Practices

copy-- SOA format:
-- primary hostmaster serial refresh retry expire minttl
INSERT INTO dns_records VALUES
('example.com', 'SOA',
 'ns1.example.com hostmaster.example.com
  2024010101 10800 3600 604800 86400', 86400);

-- Update SOA serial after changes
sudo -u dnsuser /var/nx9-dns-server/soa-update.sh

-- TTL guidelines:
-- 300–900s  → frequently changing records
-- 3600s     → standard records (A, MX, TXT)
-- 86400s    → stable records (NS, SOA)

Key Generation & Setup

copy# 1. Install key generation tool
sudo apt-get install bind9-dnsutils   # Debian/Ubuntu
sudo yum install bind-utils           # CentOS/RHEL

# 2. Generate 2048-bit RSASHA256 keypair
dnssec-keygen -a RSASHA256 -b 2048 \
  -n ZONE yourdomain.tld
# Produces: Kyourdomain.tld.+008+12345.key
#           Kyourdomain.tld.+008+12345.private

# 3. Install key and set env var
sudo cp Kyourdomain.tld.+008+12345.key \
  /var/nx9-dns-server/
export DNSSEC_KEY_FILE="/var/nx9-dns-server/Kyourdomain.tld.+008+12345.key"

# 4. (Optional) preprocess key format
sudo -u dnsuser /var/nx9-dns-server/preprocess-key.sh

# 5. Restart and verify
sudo systemctl restart dns-server
dig @localhost yourdomain.tld A +dnssec

Verify & Submit DS to Registrar

copy# Check DNSKEY is being served
dig @localhost yourdomain.tld DNSKEY

# Verify RRSIG on A record
dig @localhost yourdomain.tld A +dnssec

# Trace full DNSSEC chain
dig @localhost yourdomain.tld A \
  +dnssec +trace

# Generate DS record → submit to registrar
dnssec-dsfromkey Kyourdomain.tld.+008+12345.key

# Check signature expiry
dig @localhost yourdomain.tld SOA \
  +dnssec | grep RRSIG

# Key rotation: generate new key, update
# DNSSEC_KEY_FILE, restart, resubmit DS
sudo systemctl restart dns-server

Common Issues & Fixes

Health Checks & Monitoring

copy# DNS health one-liner
dig @192.168.1.10 example.com A +short \
  | grep -q "^[0-9]" && echo "DNS OK" || echo "FAILED"

# API health
curl -s http://localhost:8081/api/v1/health \
  | grep -q "ok" && echo "API OK"

# Prometheus scrape config
scrape_configs:
  - job_name: 'nx9-dns-server'
    scrape_interval: 15s
    static_configs:
      - targets: ['192.168.1.10:9100']

# Import Grafana dashboard
# Dashboard JSON: tools/grafana/nx9-dns-dashboard.json