DNSSEC

[jottekop]

Is the acme-dns ever going support DNSSEC or possibility to sign via secondary signing server or something the like so that we create more secure records via the API? This will greatly help the effort to make the internet more secure 😄

[jderuiter]

I was also looking for DNSSEC support and ended up using CoreDNS for this. It has a plugin to add DNSSEC signature on-the-fly (https://coredns.io/plugins/dnssec/). Maybe this also works for you. For a acme-dns server listening on localhost port 5353, you could use something like the following config:

example.org {
    bind  <public interface>

    dnssec {
        key file <path to keyfile>
    }
    forward . 127.0.0.1:5353
}