Skip to content

Enable DNSSEC stage 2: DS record at the registrar #194

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
irvingpop merged 1 commit into from
Nov 3, 2026
Merged

Enable DNSSEC stage 2: DS record at the registrar #194

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 24 additions & 17 deletions terraform/dns_operationcode_org_security.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,25 +98,32 @@ resource "aws_route53_hosted_zone_dnssec" "operationcode" {
depends_on = [aws_route53_key_signing_key.operationcode]
}

# Stage 2: DS record at the registrar (Route53 Domains, us-east-1). Keep commented out until:
# 1. signing is verified: `aws route53 get-dnssec --hosted-zone-id <zone id>` shows SIGNING and the
# KSK ACTIVE, and `dig +dnssec operationcode.org SOA` returns RRSIG records
# 2. the max TTL in the zone has passed since signing started (NS: 172800s = 48h; other records: 3600s)
# Rollback order: remove the DS record first, wait for the DS TTL at the .org parent (and the
# Stage 2: DS record at the registrar (Route53 Domains, us-east-1). This completes the DNSSEC
# chain of trust from .org to this zone. Enabled 2026-11-03, after signing ran for 53 hours
# (longer than the 48h apex NS TTL) and every checked RRset validated against KSK tag 23956.
# Rollback order: remove this DS record first, wait for the DS TTL at the .org parent (and the
# registrar change) to pass, then disable signing (aws_route53_hosted_zone_dnssec signing_status = "NOT_SIGNING").
# Disabling signing while the DS record is live makes the domain fail resolution for validating resolvers.
#
# resource "aws_route53domains_delegation_signer_record" "operationcode" {
# provider = aws.us_east_1
# domain_name = "operationcode.org"
#
# signing_attributes {
# algorithm = aws_route53_key_signing_key.operationcode.signing_algorithm_type
# flags = aws_route53_key_signing_key.operationcode.flag
# public_key = aws_route53_key_signing_key.operationcode.public_key
# }
# }
# Disabling signing or deleting the KSK while the DS record is live makes the domain fail
# resolution for validating resolvers.
resource "aws_route53domains_delegation_signer_record" "operationcode" {
provider = aws.us_east_1
domain_name = "operationcode.org"

signing_attributes {
algorithm = aws_route53_key_signing_key.operationcode.signing_algorithm_type
flags = aws_route53_key_signing_key.operationcode.flag
public_key = aws_route53_key_signing_key.operationcode.public_key
}

# The provider does not read signing_attributes back (import and refresh leave them empty),
# which would force a destroy/recreate of the live DS record. A KSK rotation needs a new DS
# record anyway, so ignore drift here and replace the DS deliberately during a rotation.
lifecycle {
ignore_changes = [signing_attributes]
}

depends_on = [aws_route53_hosted_zone_dnssec.operationcode]
}
# ======================================================================
# Query logging
# ======================================================================
Expand Down
Loading