Skip to content

Commit b4b8053

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #273920 from greg-lindsay/dns-dnssec
DNSSEC public preview release
2 parents 807bc21 + 3e60556 commit b4b8053

17 files changed

+574
-0
lines changed

‎articles/dns/TOC.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,8 @@
8383
href: dns-alias.md
8484
- name: Delegation with Azure DNS
8585
href: dns-domain-delegation.md
86+
- name: DNSSEC
87+
href: dnssec.md
8688
- name: FAQ
8789
href: dns-faq.yml
8890
- name: DNS metrics and alerts
@@ -121,6 +123,12 @@
121123
items:
122124
- name: Alias records for load balanced web apps
123125
href: dns-alias-appservice.md
126+
- name: Manage DNSSEC
127+
items:
128+
- name: Sign a DNS zone
129+
href: dnssec-how-to.md
130+
- name: Unsign a DNS zone
131+
href: dnssec-unsign.md
124132
- name: Manage DNS zones
125133
items:
126134
- name: Azure portal

‎articles/dns/dnssec-how-to.md

Lines changed: 190 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,190 @@
1+
---
2+
title: How to sign your Azure Public DNS zone with DNSSEC (Preview)
3+
description: Learn how to sign your Azure public DNS zone with DNSSEC.
4+
author: greg-lindsay
5+
ms.service: azure-dns
6+
ms.topic: how-to
7+
ms.date: 10/08/2024
8+
ms.author: greglin
9+
---
10+
11+
# How to sign your Azure Public DNS zone with DNSSEC (Preview)
12+
13+
This article shows you how to sign your DNS zone with [Domain Name System Security Extensions (DNSSEC)](dnssec.md).
14+
15+
To remove DNSSEC signing from a zone, see [How to unsign your Azure Public DNS zone](dnssec-unsign.md).
16+
17+
> [!NOTE]
18+
> DNSSEC zone signing is currently in PREVIEW.<br>
19+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
20+
21+
## Prerequisites
22+
23+
* The DNS zone must be hosted by Azure Public DNS. For more information, see [Manage DNS zones](/azure/dns/dns-operations-dnszones-portal).
24+
* The parent DNS zone must be signed with DNSSEC. Most major top level domains (.com, .net, .org) are already signed.
25+
26+
## Sign a zone with DNSSEC
27+
28+
To protect your DNS zone with DNSSEC, you must first sign the zone. The zone signing process creates a delegation signer (DS) record that must then be added to the parent zone.
29+
30+
## [Azure portal](#tab/sign-portal)
31+
32+
To sign your zone with DNSSEC using the Azure portal:
33+
34+
1. On the Azure portal Home page, search for and select **DNS zones**.
35+
2. Select your DNS zone, and then from the zone's **Overview** page, select **DNSSEC**. You can select **DNSSEC** from the menu at the top, or under **DNS Management**.
36+
37+
[ ![Screenshot of how to select DNSSEC.](./media/dnssec-how-to/select-dnssec.png) ](./media/dnssec-how-to/select-dnssec.png#lightbox)
38+
39+
3. Select the **Enable DNSSEC** checkbox.
40+
41+
![Screenshot of selecting the DNSSEC checkbox.](./media/dnssec-how-to/sign-dnssec.png)
42+
43+
4. When you are prompted to confirm that you wish to enable DNSSEC, select **OK**.<br>
44+
45+
![Screenshot of confirming DNSSEC signing.](./media/dnssec-how-to/confirm-dnssec.png)
46+
47+
5. Wait for zone signing to complete. After the zone is signed, review the **DNSSEC delegation information** that is displayed. Notice that the status is: **Signed but not delegated**.
48+
49+
[ ![Screenshot of a signed zone with DS record missing.](./media/dnssec-how-to/ds-missing.png) ](./media/dnssec-how-to/ds-missing.png#lightbox)
50+
51+
6. Copy the delegation information and use it to create a DS record in the parent zone.
52+
53+
1. If the parent zone is a top level domain (for example: `.com`), you must add the DS record at your registrar. Each registrar has its own process. The registrar might ask for values such as the Key Tag, Algorithm, Digest Type, and Key Digest. In the example shown here, these values are:
54+
55+
**Key Tag**: 4535<br>
56+
**Algorithm**: 13<br>
57+
**Digest Type**: 2<br>
58+
**Digest**: 7A1C9811A965C46319D94D1D4BC6321762B632133F196F876C65802EC5089001
59+
60+
When you provide the DS record to your registrar, the registrar adds the DS record to the parent zone, such as the Top Level Domain (TLD) zone.
61+
62+
2. If you own the parent zone, you can add a DS record directly to the parent yourself. The following example shows how to add a DS record to the DNS zone **adatum.com** for the child zone **secure.adatum.com** when both zones are hosted using Azure Public DNS:
63+
64+
[ ![Screenshot of adding a DS record to the parent zone.](./media/dnssec-how-to/ds-add.png) ](./media/dnssec-how-to/ds-add.png#lightbox)
65+
[ ![Screenshot of a DS record in the parent zone.](./media/dnssec-how-to/ds-added.png) ](./media/dnssec-how-to/ds-added.png#lightbox)
66+
67+
3. If you don't own the parent zone, send the DS record to the owner of the parent zone with instructions to add it into their zone.
68+
69+
7. When the DS record has been uploaded to the parent zone, select the DNSSEC information page for your zone and verify that **Signed and delegation established** is displayed. Your DNS zone is now fully DNSSEC signed.
70+
71+
[ ![Screenshot of a fully signed and delegated zone.](./media/dnssec-how-to/delegated.png) ](./media/dnssec-how-to/delegated.png#lightbox)
72+
73+
## [Azure CLI](#tab/sign-cli)
74+
75+
1. Sign a zone using the Azure CLI:
76+
77+
```azurepowershell-interactive
78+
# Ensure you are logged in to your Azure account
79+
az login
80+
81+
# Select the appropriate subscription
82+
az account set --subscription "your-subscription-id"
83+
84+
# Enable DNSSEC for the DNS zone
85+
az network dns dnssec-config create --resource-group "your-resource-group" --zone-name "adatum.com"
86+
87+
# Verify the DNSSEC configuration
88+
az network dns dnssec-config show --resource-group "your-resource-group" --zone-name "adatum.com"
89+
```
90+
91+
2. Obtain the delegation information and use it to create a DS record in the parent zone.
92+
93+
You can use the following Azure CLI command to display the DS record information:
94+
95+
```azurepowershell-interactive
96+
az network dns zone show --name "adatum.com" --resource-group "your-resource-group" | jq '.signingKeys[] | select(.delegationSignerInfo != null) | .delegationSignerInfo'
97+
```
98+
Sample output:
99+
100+
```
101+
{
102+
"digestAlgorithmType": 2,
103+
"digestValue": "0B9E68FC1711B4AC4EC0FCE5E673EDB0AFDC18F27EA94861CDF08C7100EA776C",
104+
"record": "26767 13 2 0B9E68FC1711B4AC4EC0FCE5E673EDB0AFDC18F27EA94861CDF08C7100EA776C"
105+
}
106+
```
107+
108+
Alternatively, you can also obtain DS information by using dig.exe on the command line:
109+
110+
```Cmd
111+
dig adatum.com DS +dnssec
112+
```
113+
114+
Sample output:
115+
116+
```Cmd
117+
;; ANSWER SECTION:
118+
adatum.com. 86400 IN DS 26767 13 2 0B9E68FC1711B4AC4EC0FCE5E673EDB0AFDC18F27EA94861CDF08C71 00EA776C
119+
```
120+
In these examples, the DS values are:
121+
- Key Tag: 26767
122+
- Algorithm: 13
123+
- Digest Type: 2
124+
- Digest: 0B9E68FC1711B4AC4EC0FCE5E673EDB0AFDC18F27EA94861CDF08C7100EA776C
125+
126+
127+
3. If the parent zone is a top level domain (for example: `.com`), you must add the DS record at your registrar. Each registrar has its own process.
128+
129+
4. If you own the parent zone, you can add a DS record directly to the parent yourself. The following example shows how to add a DS record to the DNS zone **adatum.com** for the child zone **secure.adatum.com** when both zones are signed and hosted using Azure Public DNS:
130+
131+
```azurepowershell-interactive
132+
az network dns record-set ds add-record --resource-group "your-resource-group" --zone-name "adatum.com" --record-set-name "secure" --key-tag <key-tag> --algorithm <algorithm> --digest <digest> --digest-type <digest-type>
133+
```
134+
135+
5. If you don't own the parent zone, send the DS record to the owner of the parent zone with instructions to add it into their zone.
136+
137+
## [PowerShell](#tab/sign-powershell)
138+
139+
1. Sign and verify your zone using PowerShell:
140+
141+
```PowerShell
142+
# Connect to your Azure account (if not already connected)
143+
Connect-AzAccount
144+
145+
# Select the appropriate subscription
146+
Select-AzSubscription -SubscriptionId "your-subscription-id"
147+
148+
# Enable DNSSEC for the DNS zone
149+
New-AzDnsDnssecConfig -ResourceGroupName "your-resource-group" -ZoneName "adatum.com"
150+
151+
# Verify the DNSSEC configuration
152+
Get-AzDnsDnssecConfig -ResourceGroupName "your-resource-group" -ZoneName "adatum.com"
153+
```
154+
155+
2. Obtain the delegation information and use it to create a DS record in the parent zone.
156+
157+
```PowerShell
158+
Get-AzDnsDnssecConfig -ResourceGroupName "dns-rg" -ZoneName "adatum.com" | Select-Object -ExpandProperty SigningKey | Select-Object -ExpandProperty delegationSignerInfo
159+
```
160+
161+
Example output:
162+
163+
```PowerShell
164+
DigestAlgorithmType DigestValue Record
165+
------------------- ----------- ------
166+
2 0B9E68FC1711B4AC4EC0FCE5E673EDB0AFDC18F27EA94861CDF08C7100EA776C 26767 13 2 0B9E68FC1711B4AC4EC0FCE5E673EDB0AFDC18F27EA94861CDF08C7100EA776C
167+
```
168+
169+
In these examples, the DS values are:
170+
- Key Tag: 26767
171+
- Algorithm: 13
172+
- Digest Type: 2
173+
- Digest: 0B9E68FC1711B4AC4EC0FCE5E673EDB0AFDC18F27EA94861CDF08C7100EA776C
174+
175+
3. If the parent zone is a top level domain (for example: `.com`), you must add the DS record at your registrar. Each registrar has its own process.
176+
177+
4. If you own the parent zone, you can add a DS record directly to the parent yourself. The following example shows how to add a DS record to the DNS zone **adatum.com** for the child zone **secure.adatum.com** when both zones are signed and hosted using Azure Public DNS. Replace \<key-tag\>, \<algorithm\>, \<digest\>, and \<digest-type\> with the appropriate values from the DS record you queried previously.
178+
179+
```PowerShell
180+
$dsRecord = New-AzDnsRecordConfig -DnsRecordType DS -KeyTag <key-tag> -Algorithm <algorithm> -Digest <digest> -DigestType <digest-type>
181+
New-AzDnsRecordSet -ResourceGroupName "dns-rg" -ZoneName "adatum.com" -Name "secure" -RecordType DS -Ttl 3600 -DnsRecords $dsRecord
182+
```
183+
5. If you don't own the parent zone, send the DS record to the owner of the parent zone with instructions to add it into their zone.
184+
---
185+
186+
## Next steps
187+
188+
- Learn how to [unsign a DNS zone](dnssec-unsign.md).
189+
- Learn how to [host the reverse lookup zone for your ISP-assigned IP range in Azure DNS](dns-reverse-dns-for-azure-services.md).
190+
- Learn how to [manage reverse DNS records for your Azure services](dns-reverse-dns-for-azure-services.md).

‎articles/dns/dnssec-unsign.md

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
---
2+
title: How to unsign your Azure Public DNS zone (Preview)
3+
description: Learn how to remove DNSSEC from your Azure public DNS zone.
4+
author: greg-lindsay
5+
ms.service: azure-dns
6+
ms.topic: how-to
7+
ms.date: 10/08/2024
8+
ms.author: greglin
9+
---
10+
11+
# How to unsign your Azure Public DNS zone (Preview)
12+
13+
This article shows you how to remove [Domain Name System Security Extensions (DNSSEC)](dnssec.md) from your Azure Public DNS zone.
14+
15+
To sign a zone with DNSSEC, see [How to sign your Azure Public DNS zone with DNSSEC](dnssec-how-to.md).
16+
17+
> [!NOTE]
18+
> DNSSEC zone signing is currently in PREVIEW.<br>
19+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
20+
21+
## Prerequisites
22+
23+
* The DNS zone must be hosted by Azure Public DNS. For more information, see [Manage DNS zones](/azure/dns/dns-operations-dnszones-portal).
24+
* You must have permission to delete a DS record from the parent DNS zone. Most top level domains (.com, .net, .org) allow you to do this using your registrar.
25+
26+
## Unsign a zone
27+
28+
> [!IMPORTANT]
29+
> Removing DNSSEC from your DNS zone requires that you first remove the delegation signer (DS) record from the parent zone, and wait for the time-to-live (TTL) of the DS record to expire. After the DS record TTL has expired, you can safely unsign the zone.
30+
31+
## [Azure portal](#tab/sign-portal)
32+
33+
To unsign a zone using the Azure portal:
34+
35+
1. On the Azure portal Home page, search for and select **DNS zones**.
36+
2. Select your DNS zone, and then from the zone's **Overview** page, select **DNSSEC**. You can select **DNSSEC** from the menu at the top, or under **DNS Management**.
37+
3. If you have successfully removed the DS record at your registrar for this zone, you see that the DNSSEC status is **Signed but not delegated**. Do not proceed until you see this status.
38+
39+
![Screenshot of confirming to disable DNSSEC.](./media/dnssec-how-to/ds-removed.png)
40+
41+
4. Clear the **Enable DNSSEC** checkbox and select **OK** in the popup dialog box confirming that you wish to disable DNSSEC.
42+
43+
![Screenshot of DNSSEC status.](./media/dnssec-how-to/disable-dnssec.png)
44+
45+
5. In the **Disable DNSSEC** pane, type the name of your domain and then select **Disable**.
46+
47+
![Screenshot of the disable DNSSEC pane.](./media/dnssec-how-to/disable-pane.png)
48+
49+
6. The zone is now unsigned.
50+
51+
## [Azure CLI](#tab/sign-cli)
52+
53+
Unsign a DNSSEC-signed zone using the Azure CLI:
54+
55+
1. To unsign a signed zone, issue the following commands. Replace the values for subscription ID, resource group, and zone name with your values.
56+
57+
```azurepowershell-interactive
58+
# Ensure you are logged in to your Azure account
59+
az login
60+
61+
# Select the appropriate subscription
62+
az account set --subscription "your-subscription-id"
63+
64+
# Disable DNSSEC for the DNS zone
65+
az network dns dnssec-config delete --resource-group "your-resource-group" --zone-name "adatum.com"
66+
67+
# Verify the DNSSEC configuration has been removed
68+
az network dns dnssec-config show --resource-group "your-resource-group" --zone-name "adatum.com"
69+
```
70+
71+
2. Confirm that **(NotFound) DNSSEC is not enabled for DNS zone 'adatum.com'** is displayed after the last command. The zone is now unsigned.
72+
73+
## [PowerShell](#tab/sign-powershell)
74+
75+
1. Use the following commands to remove DNSSEC signing from your zone and view the zone status using PowerShell. Replace the values for subscription ID, resource group, and zone name with your values.
76+
77+
```PowerShell
78+
# Connect to your Azure account (if not already connected)
79+
Connect-AzAccount
80+
81+
# Select the appropriate subscription
82+
Select-AzSubscription -SubscriptionId "your-subscription-id"
83+
84+
# Disable DNSSEC for the DNS zone
85+
Remove-AzDnsDnssecConfig -ResourceGroupName "your-resource-group" -ZoneName "adatum.com"
86+
87+
# View the DNSSEC configuration
88+
Get-AzDnsDnssecConfig -ResourceGroupName "your-resource-group" -ZoneName "adatum.com"
89+
```
90+
91+
2. Confirm that **DNSSEC is not enabled for DNS zone 'adatum.com'** is displayed after the last command. The zone is now unsigned.
92+
93+
---
94+
95+
## Next steps
96+
97+
- Learn how to [sign a DNS zone with DNSSEC](dnssec-how-to.md).
98+
- Learn how to [host the reverse lookup zone for your ISP-assigned IP range in Azure DNS](dns-reverse-dns-for-azure-services.md).
99+
- Learn how to [manage reverse DNS records for your Azure services](dns-reverse-dns-for-azure-services.md).

0 commit comments

Comments
 (0)