<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Dear all,</p>
<p>In my not used old approach I had my zones on my server and used
vi to update them if changes were required.<br>
At this time, I just included required DKIM entries using an
include command in the zone:<br>
</p>
<pre tabindex="0"><code>$INCLUDE fechner.net.dkim.txt
</code>
</pre>
<p>This file is automatically generated on the server by rspamd and
was very convenient.<br>
If the dkim key changed for whatever reason, I just bumped the
serial of the zone and reloaded it using rndc.</p>
<p>I decided some years ago to change that well working procedure
due to several reasons:<br>
- usage of DNSSEC<br>
- track changes on zones using git<br>
- manage the zones on another machine and just update the zone on
the real server using nsdiff and nsupdate<br>
- automatic zone updates based on commits in the zones repository<br>
- usage of DNS-01 validation for wildcard SSL certificates<br>
- and many other reasons</p>
<p>So I converted my zones into a "dynamic" zone so I can update it
using nsdiff and nsupdate approach which works very nicely.<br>
To prevent dehydrated (which I use to manage my letsencrypt
certificates) that it can damage my zone I decided to delegate
this acme challenge into an extra zone file with an extra key
file.</p>
<p>So it looks like this:<br>
zone "fechner.net" {<br>
type master;<br>
file
"/usr/local/etc/namedb/master/fechner.net/fechner.net";<br>
allow-transfer { secondard-servers; key fechner.net;};<br>
dnssec-policy "one-year-zsk";<br>
inline-signing no;<br>
allow-update { key fechner.net;};<br>
};<br>
<br>
zone "_acme-challenge.fechner.net" {<br>
type master;<br>
file
"/usr/local/etc/namedb/master/fechner.net/_acme-challenge.fechner.net";<br>
masterfile-format text;<br>
allow-update { key acme_fechner.net; };<br>
};<br>
</p>
<p>Now I want to automate the complete management partly using
saltstack.</p>
<p>What do you suggest, how should I handle the DKIM part?<br>
I would like to have the keys on the server (and not in saltstack,
as they must not be permanent, they must only be consistent), so
no need to have even the public part in my git repository for the
zones.</p>
<p>What kind of solution do you suggest?</p>
<p>Should I also delegate the DKIM part into its own zone file where
I maybe can use the $INCLUDE feature?</p>
<p>Any comments are welcome!</p>
<p>Thanks a lot<br>
Matthias</p>
</body>
</html>