Support for nsupdate

[tarnfeld]

It'd be useful to support the nsupdate mechanism to allow users to more easily insert records into discodns. The tool seems to be widely installed, so wouldn't require any custom software and is seen as a standard.

For this to work, I believe we need to support DNSSEC authentication, which is something that'd be great to support anyway. The DNS library being used here already works with DNSSEC so it shouldn't be too complex to implement. I've opened #17 to track that.

Edit: DNSSEC is not the level authentication used here, it's the TSIG shared secret. My mistake.

[orls]

I haven't looked into this much, but I believe it's theoretically possible to allow updates without requiring DNSSEC – certainly the original RFCs allowed it, but the rest of the world (BIND, nsupdate, any libraries we're likely to use, and every bit of documentation) seem to assume DNSSEC as default.

I agree that we should end up with DNSSEC, but I'd recommend a divide-and-conquer approach; I think it might be worth exploring updates without DNSSEC first, then layering it on afterwards.

In part, that's because I'd like the option – at least for development and small, internal uses – of performing updates without the added overhead of credentials management; generating and shipping around keys and secrets, all that jazz

[tarnfeld]

The DNS library we're using has support for TSIG which I feel we should require for authenticated domain name updates. It's easy enough to implement on the first iteration.

I do agree that it's worth putting off DNSSEC for a little bit though, and it's a separate concern.

[miekg]

I think you might want to use SIG(0), but I haven't added support for this in go dns (yet) [Quite a bit of work and almost nobody needs/wants it]