B4L/cnx-network-clan
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enable DNSSEC and automatic SOA serials on the DNS zones

Browse Source 
ns1 (primary) now signs every zone with an ECDSA P-256/SHA-256 policy and
manages the SOA serial itself: zonefile-load = difference-no-serial (with
journal-content = all) plus serial-policy = dateserial let records be edited
without bumping the serial by hand. ns2 needs no change; it transfers the
already-signed zone.

Also point the ns1/ns2 AAAA glue at the public Hetzner IPv6 addresses; they
previously pointed at unroutable ZeroTier mesh ULAs.
This commit is contained in:
Berwn
2026-06-14 16:27:30 +07:00
parent 5864054b00
commit dc51cfbdb5
4 changed files with 24 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/dns/zones/cnx.email.zone
+1 -1
View File
@@ -2,7 +2,7 @@ $ORIGIN cnx.email.
$TTL 3600
@ IN SOA ns1.cnx.network. hostmaster.cnx.network. (
2026061401 ; serial (bump on every edit: YYYYMMDDnn)
2026061401 ; serial (ignored: Knot auto-assigns a dateserial on signing)
3600 ; refresh
900 ; retry
604800 ; expire