pdnsutil rectify-zone

[victoredvardsson]

Hello,

When setting set-nsec3 parameters you are advised to rectify the zone (Depending on backend). In our case we use the lmdb backend but i cannot find any documentation if it's needed for that specific backend.

pdnsutil set-nsec3 edvsn.eu NSEC3 set, Done, please rectify your zone if your backend needs it (or reload it if you are using the bindbackend)

Hope you can help me sort this out 🙏

[miodvallat]

pdnsutil rectify-zone is indeed needed when using the LMDB backend.

I'll see if I can make the message more precise.

[victoredvardsson]

Thanks for a quick reply, so as i understand it is only needed when setting the nsec3 parameters?

[miodvallat]

When changing them.

[victoredvardsson]

Hello again, on a similar topic.

https://doc.powerdns.com/authoritative/http-api/zone.html

Im not sure i fully understand this part below, would that mean that we need to rectify zone after each zone change? eg. creating/updating/delete RRsets?

For context we will use native replication with lmdb backend and online signing mode.

DNSSEC-enabled zones should be rectified after changing the zone data. This can be done by the API automatically after a change when the ALLOW-DNSUPDATE-FROM, FORWARD-DNSUPDATE, NOTIFY-DNSUPDATE, SOA-EDIT-DNSUPDATE metadata is set. When creating or updating a zone, the “api_rectify” field of the Zone can be set to true to enable this behaviour.

Sorry to disturb you with all these questions, we are currently in the process of replacing knot with powerdns. So need to make sure that i get these things right :)

[miodvallat]

If you are using DNSSEC, you must "rectify" your zone after every addition or removal of records (changing the contents of an existing record does not require a rectify operation).

If you set the API-RECTIFY zone metadata to 1, then this operation will always be performed on your behalf, after zone changes performed with the API. If this zone metadata does not exist or has a different value, you will need to perform that operation manually (this can be preferable if you are doing large batches of zone edits), either using pdnsutil or the .../zones/.../rectify API endpoint.