Dynamic Zone Files
I run my own dns servers. It all started when I wanted to put my SSHFP records in my DNS. At the time, I had a small child, and a trip to DisneyLand was not an unexpected weekend trip. But I didn't quite trust the hotel internet connections back then, and wanted to make sure that I was actually connecting to my little server. SSHFP records were a way to validate that no one in the hotel was running some MITM attack to try to get anything. If they knew my server, they wouldn't want it, but still.
So over the years, I now have four DNS servers scattered across the States, all with different providers, completely robust; the only global failure would be if my billing doesn't go through.
Adding to my Bind9 servers, I've hooked up Traefik and have fought through sometimes confusing or lacking documentation to configure Traefik/lego to use RFC2136 to issue DNS challenges for wildcard domains. Doing this required all my zone files to become dynamic. That's fine, of course there's nothing wrong with dynamic zones.
Except for my comments. I had my zone files littered with comments: old IP addresses to reference if I had hardcoded an
address that I forgot; domain renewal dates; specific VPC machines that housed a domain. And my include files. It was
simple to have an include file that held all the common NS records and a CNAME for opengpgkey, for a domain hosted on
GitLab Pages, or if it had Google SMTP servers, or Zoho, or other commonalities that would be best for include files.
The loss of comments saddened me, but I figured I could take a JSON string, and encode it with an Age Key and add it as a TXT record on an _infra host. I still have the data available, and no one else knows my secrets. Of course, who needs to know when my annual renewal is due besides me, right?
Wanting an easy way to create these encrypted TXT records, I created ZoneForge. It requires your TSIG key to send updates to your hosted Bind9 server for all record types, and uses your own Age Key to encrypt and decrypt the _infra TXT records. It's still in pre-release/bugfix/finalizing stage, but I've been able to change the DNS settings for Is Dave Canales Gone Yet, and I've added records to a new domain.
You will need to have a zone already added in your named.conf files, and a TSIG key with the proper grants, and I need
to finish configuration, but that will be coming shortly.