psa-ns

README

Intro

psa-ns was written as an enhanced drop-in replacement for tinydns.

Features

psa-ns supports most features of tinydns but also includes some enhancements.

The following table gives a brief overview:

Feature	psa-ns support	tinydns support
Can act as authorative nameserver	✅	✅
TCP Support	✅	✅ (via axfrdns)
Supports EDNS0	✅	❌
Supports EDE (RFC 8914)	✅	❌
Supports IPv6	✅	❌ (patches exist)
Supports DNSSEC	❌	❌ (patches exist)
Zone transfer	etcd / scripts	rsync / scripts
Language written in	Golang	C
Has thousands of installations and is shipped with many distributions	❌	✅

Installation

Just run

$ go build cmd/psa-ns.go

to build the main binary.

After this, you can start writing your zone file which would typically be called data.

Zone file format

psa-ns uses the same zone file format as tinydns. See https://cr.yp.to/djbdns/tinydns-data.html for details.

All features of tinydns-data excluding the 'loc' format are supported. psa-ns also supports some custom verbs to simplify IPv6 support. See psa-zone-format for psa-ns specific details.

Sample zone (data) file

# SOA with ns-a.example.com
.example.com::ns-a.example.com
# another NS
&example.com::ns-b.example.com
# NS with auto-generated A record and auto fqdn expansion
&example.com:192.168.1.11:foo
# Define an MX with distance 5
@example.com:192.168.1.12:mx-a.example.com:5
# A record
=example.com:192.168.1.1:30
# AAAA record
6example.com:2a000000000000000000000000000001:30
# AAAA record for MX
6mx-a.example.com:2a0000000000000000000000000000be:30
# A for ns-a.example.com
=ns-a.example.com:192.168.1.12:30

Building the data file

Once you created your data file, you'll have to convert it into psa-ns's (tinydns-data compatible) binary format. This can be done by running:

$ psa-ns -make-data

...which will create a data.cdb file. Just like with tinydns, this is an atomic operation and can be safely executed while psa-ns is running.

Running psa-ns

In the directory in which data.cdb is located, just run:

# change binary owner to root.root and allow psa-ns to bind
# to port 53 as a normal user.
$ sudo chown root:root psa-ns
$ sudo setcap cap_net_bind_service=ep
$ psa-ns -listen 127.0.0.1:53

See psa-ns --help for more options.

ETCD support

psa-ns supports data file retrival via etcd.

This is optional but can be very handy to distribute zone file updates to multiple servers.

To use this feature, launch psa-ns like this:

export ETCD_ADDRESS=http://127.0.0.1:2379
# ETCD user which has access to the specified `-etcd-key`
export ETCD_USERNAME=some-user
export ETCD_PASSWORD=foobar

psa-ns -listen '[2001::f00]:53,192.168.1.1:53' \
  -etcd-key=/dns/zone/prod -etcd-mark=EOF_MARKER 2>&1

This will cause psa-ns to watch for changes/updates on /dns/zone/prod and (once they happened) build a data.cdb from the read data. As a paranoia mechanism, the data will only be used if psa-ns can find the string EOF_MARKER in the supplied data (may be a plain comment). This protects against accidential key deletions: In such a scenario, psa-ns would simply refuse the data from etcd and continue serving from the existing / old data file.

Note that psa-ns always keeps a copy of the zone file in its own directory (and hence needs write access to it), making etcd a non critical dependency.