https://coredns.io/tags/dnssec/ Recent content in dnssec on CoreDNS: DNS and Service Discovery Hugo -- gohugo.io en-us CoreDNS - All Rights Reserved Fri, 22 Nov 2024 08:09:54 +0000 https://coredns.io/plugins/dnssec/ Fri, 22 Nov 2024 08:09:54 +0000 https://coredns.io/plugins/dnssec/ Description With dnssec, any reply that doesn’t (or can’t) do DNSSEC will get signed on the fly. Authenticated denial of existence is implemented with NSEC black lies. Using ECDSA as an algorithm is preferred as this leads to smaller signatures (compared to RSA). NSEC3 is not supported. This plugin can only be used once per Server Block. Syntax dnssec [ZONES... ] { key file|aws_secretsmanager KEY... cache_capacity CAPACITY } The signing behavior depends on the keys specified.