PowerDNS contains support for DNSSEC, enabling the easy serving of DNSSEC secured data, with minimal administrative overhead.
In PowerDNS, DNS and signatures and keys are (usually) treated as separate entities. The domain & record storage is thus almost completely devoid of DNSSEC record types.
Instead, keying material is stored separately, allowing operators to focus on the already complicated task of keeping DNS data correct. In practice, DNSSEC related material is often stored within the same database, but within separate tables.
If a DNSSEC configuration is found for a domain, the PowerDNS daemon will provide key records, signatures and (hashed) denials of existence automatically.
As an example, securing an existing zone can be as simple as:
$ pdnsutil secure-zone powerdnssec.org
Alternatively, PowerDNS can serve pre-signed zones, without knowledge of private keys.
PowerDNS DNSSEC has been made possible by the help & contributions of many people. We would like to thank:
and everyone else who contributed to making this possible.