Post B6Yo8cbozRKyLfaMaW by r@glauca.space
 (DIR) More posts by r@glauca.space
 (DIR) Post #B6YnDWaKiMjz9vfBnE by r@glauca.space
       0 likes, 0 repeats
       
       self-hosting status: DKIM is _really annoying_ if you have manually-managed DNS zones everywhere?it's not designed for domain-hoarding virtual hosting AND rapid key rotation (trying to copy ryanc's breaking of DKIM non-repudiation)is there a "good" database-driven and API-controllable DNS server, or are they all custom hyperscaler in-house software?
       
 (DIR) Post #B6YnDWpvmNDXwIxe6a by domi@donotsta.re
       0 likes, 0 repeats
       
       @r wait, how often do you want to rotate it? all DKIM deployments i’ve ever seen are “deploy once, rotate maybe”, not something continuous
       
 (DIR) Post #B6YnDdaweUOCtr0HDc by r@glauca.space
       0 likes, 0 repeats
       
       i already have a bunch of complexity because each anycast DNS server responds with *different* data
       
 (DIR) Post #B6YnluuEnPSYR3NBoW by r@glauca.space
       0 likes, 0 repeats
       
       @domi blame ryanc https://rya.nc/dkim-privates.htmlwas thinking weekly-ish
       
 (DIR) Post #B6Ynlv5a7EX90EgFUm by domi@donotsta.re
       0 likes, 0 repeats
       
       @r oh, okay, i think I get your usecase now.I think the secret sauce here is to always name your new record a different thing, and never reuse record names? this way TTL can’t bite your ass, and you have something to refer to if you ever were to check “hmm, was this key even mine?”as for automation: i love PowerDNS’ http api, that’s also what servfail dns is exposing. but virtually every modern authoritative server has some sort of API for this now
       
 (DIR) Post #B6Yo8cbozRKyLfaMaW by r@glauca.space
       0 likes, 0 repeats
       
       @domi the problem is that i've also hoarded something like 30 domains (and can't get myself to let any of them go)it's not the TTL that's annoying, it's having to go through *all* of the zones
       
 (DIR) Post #B6Yo8d0dVBBdadCBGa by domi@donotsta.re
       0 likes, 0 repeats
       
       @r will you ever send mail from more than three of those? genuine question
       
 (DIR) Post #B6YoHcsRMYBVmneVxg by r@glauca.space
       0 likes, 0 repeats
       
       @domi so even just "you 'only' have to set this up once" starts to scale very poorly when setting up currently involvessudo vi /etc/named.conf
       
 (DIR) Post #B6YoHd6cVpWkUmHq40 by erincandescent@erincandescent.net
       1 likes, 0 repeats
       
       @r @domi _dkim.(each domain) IN DNAME _dkim.primary.domain.
       
 (DIR) Post #B6ZTRSqPcCYJgdVuPQ by erincandescent@erincandescent.net
       0 likes, 0 repeats
       
       @r I just use Knot and update things with DNS UPDATEs signed with TSIG
       
 (DIR) Post #B6ZTRTEs9G7OuUxRXE by erincandescent@erincandescent.net
       1 likes, 0 repeats
       
       @r I keep my main zones as boring as possible so I can just replicate them with a catalog zone and if I need dyanmic stuff or different responses under anycast or similar, I CNAME from the boring zone into the exciting zone