bns
bns copied to clipboard
chjj
Recursive DNS server and resolver for node.js
Closes #35 and maybe even #28 (for second part, doesn't check `cd`). Changes: - JS Recursive Resolver: Add `bogus` flag to `ResolveContext` and set it when verification breaks - Unbound...
All popular resolvers (1.1.1.1, 8.8.8.8, etc.) do not return records if DNSSEC verification fails. But `bns` returns records with the `ad` flag (correctly) unset. other resolvers: ``` ❯ dig @8.8.8.8...
These changes allow a TLD owner who is stuck with a `RSASHA1` key in the root zone to claim their reserved name on Handshake using the same RSA key but...
Closes #5 Closes #21 Closes #16 Closes #15 A few edge cases aren't complete, indicated by `skip` in some of the tests. Test cases were designed to match results from...
This will be connected with a PR to hsd to fix some lingering issues with ipv6. 1) We used to only allow ipv6 by default if we detected public ipv6...
Closes https://github.com/chjj/bns/issues/29 This PR enables ICANN TLD holders to claim their reserved names on Handshake by signing offline with an HSM. This was an explicit ask by such an interested...
`keyFlags.ZSK` is used in the tests but not actually defined: https://github.com/chjj/bns/blob/03b0ea5e7587774c0c3ad363f094a069acc1e60b/test/dnssec-test.js#L157
ICANN TLD owners can claim their names on Handshake following the reserved name-claim process. However, [TXT records are prohibited in the apex of a TLD zone](https://newgtlds.icann.org/sites/default/files/agreements/agreement-approved-31jul17-en.html#exhibitA.1), so those users will...
I mentioned this in hsd and hnsd as well. Unbound has two variables in the result secure and bogus. 1. In all cases, if the answer is bogus we should...
There's going to be a lot of logs in this post. In summary, running hsd with `--rs-no-unbound` fails to verify the subdomain `sebastian.rasor` whereas the unbound resolver does verify it:...