For permissions, a number of per zone settings are available via the domain metadata (See Chapter 15, Per zone settings aka Domain Metadata).
This setting has the same function as described in the configuration options (See Section 1, “Configuration options”). Only one item is allowed per row, but multiple rows can be added. An example:
sql> select id from domains where name='powerdnssec.org'; 5 sql> insert into domainmetadata(domain_id, kind, content) values(5, ‘ALLOW-2136-FROM’,’10.0.0.0/8’); sql> insert into domainmetadata(domain_id, kind, content) values(5, ‘ALLOW-2136-FROM’,’192.168.1.2/32’);
This will allow 10.0.0.0/8 and 192.168.1.2/32 to send RFC2136 update messages for the powerdnssec.org domain.
This setting allows you to set the TSIG key required to do an RFC2136 update. An example:
sql> insert into tsigkeys (name, algorithm, secret) values ('test', 'hmac-md5', 'kp4/24gyYsEzbuTVJRUMoqGFmN3LYgVDzJ/3oRSP7ys='); sql> select id from domains where name='powerdnssec.org'; 5 sql> insert into domainmetadata (domain_id, kind, content) values (5, 'TSIG-ALLOW-2136', 'test');
An example of how to use a TSIG key with the nsupdate command:
nsupdate <<! server <ip> <port> zone powerdnssec.org update add test1.powerdnssec.org 3600 A 192.168.1.1 key test kp4/24gyYsEzbuTVJRUMoqGFmN3LYgVDzJ/3oRSP7ys= send !
If a TSIG key is set for the domain, it is required to be used for the update. The TSIG is extra security on top of the ALLOW-2136-FROM setting. If a TSIG key is set, the IP(-range) still needs to be allowed via ALLOW-2136-FROM.
See Section 1, “Configuration options” for what it does, but per domain.
sql> select id from domains where name='powerdnssec.org'; 5 sql> insert into domainmetadata(domain_id, kind, content) values(5, ‘FORWARD-2136’,’’);
There is no content, the existence of the entry enables the forwarding. This domain-specific setting is only useful when the configuration option forward-2136 is set to 'no', as that will disable it globally. Using the domainmetadata setting than allows you to enable it per domain.
This configures how the soa serial should be updated. See Section 3, “SOA Serial Updates”.