功能请求：DNSSEC 及其验证
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 38.1k
- Forks
- 4.6k
- Avg merge
- 19d 15h
- Merged PRs (30d)
- 1
Description
背景：DNSSEC 是确保解析结果可信的强有力手段。不自建递归解析器的情况下，DNSSEC 的正确实施依赖于第三方递归解析器。未经验证而盲目信任第三方递归解析器返回的 DNSSEC 结果，可能引入风险。本地 DNSSEC 验证有助于减少对第三方递归解析器的信任。
功能：增加 DNSSEC 及验证功能。在 dns.rules 增加dnssec及 dnssec_verified字段匹配解析结果。
实现参考：dnssec可以检查结果中的ADflag 确定（https://datatracker.ietf.org/doc/html/rfc4035 ）。 dnssec_verified可以参考delv（https://manpages.debian.org/testing/dnsutils/delv.1.en.html ），为sb内置 DNSSEC 根区域证书。
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the dns.rules implementation and reading how DNS response flags are exposed, especially the AD flag. Compare the requested dnssec and dnssec_verified matches with RFC 4035 and the referenced delv behavior. Done should include both fields, with dnssec based on AD and dnssec_verified using the requested built-in DNSSEC root trust data.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100