Hi,
I'm running DNS for a larger campus network. We have a few thousand
zones up to six labels deep, which are sourced from our internal
systems, a customer selfservice portal, foreign master servers we slave
or even completely external entities we can't get a copy of the zone from.
We are fighting with keeping NS records in sync in parent and child
zones. This has mostly been a minor problem since most zones are on the
same servers and thus missing delegations are hidden, but becomes a
bigger problem with DNSSEC and NSEC. And of course users often change
things without giving us any heads-up.
Is there any script/framework out there already that tries to find that
mess? I'm thinking about
* getting a list of zones from management system
* check delegation from upstream server
* get zone file from our slave zone repository, walk all delegations,
check them on delegated server or in the zone repository
* warn if delegations are missing or inconsistent
* warn if delegations to non-existing/non-answering servers exist, or
delegations to own servers but zone is not configured
* DS vs. DNSKEY checks
Thanks,
Bernhard
_______________________________________________
dns-operations mailing list
[email protected]
https://lists.dns-oarc.net/mailman/listinfo/dns-operations
dns-jobs mailing list
https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
