DNSSEC Policy¶

DnssecPolicyBlock `pydantic-model` ¶

Bases: BindBaseModel

DNSSEC key and signing policy (KASP) configuration block for BIND.

Built-in policies: "default", "insecure", "none"

Grammar:

dnssec-policy <string> {
    cdnskey <boolean>;
    cds-digest-types { <string>; ... };
    dnskey-ttl <duration>;
    inline-signing <boolean>;
    keys { ... };
    manual-mode <boolean>;
    max-zone-ttl <duration>;
    nsec3param [ ... ];
    offline-ksk <boolean>;
    parent-ds-ttl <duration>;
    parent-propagation-delay <duration>;
    publish-safety <duration>;
    purge-keys <duration>;
    retire-safety <duration>;
    signatures-jitter <duration>;
    signatures-refresh <duration>;
    signatures-validity <duration>;
    signatures-validity-dnskey <duration>;
    zone-propagation-delay <duration>;
};

Show JSON schema:

{
  "$defs": {
    "DnssecAlgorithmEnum": {
      "description": "DNSSEC algorithms as defined by BIND.",
      "enum": [
        "rsamd5",
        "dh",
        "dsa",
        "rsasha1",
        "dsa-nsec3-sha1",
        "rsasha1-nsec3-sha1",
        "rsasha256",
        "rsasha512",
        "ecc-gost",
        "ecdsap256sha256",
        "ecdsap384sha384",
        "ed25519",
        "ed448"
      ],
      "title": "DnssecAlgorithmEnum",
      "type": "string"
    },
    "DnssecDigestTypeEnum": {
      "description": "DNSSEC digest types for CDS records.",
      "enum": [
        "SHA-1",
        "SHA-256",
        "SHA-384",
        "SHA-512"
      ],
      "title": "DnssecDigestTypeEnum",
      "type": "string"
    },
    "DnssecKeyEntry": {
      "description": "Key entry in dnssec-policy keys block.\n\nGrammar:\n```\n( csk | ksk | zsk ) [ key-directory | key-store <string> ]\n         lifetime <duration_or_unlimited> algorithm <string>\n         [ tag-range <integer> <integer> ] [ <integer> ];\n```",
      "properties": {
        "comment": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Optional comment for this block",
          "title": "Comment"
        },
        "role": {
          "$ref": "#/$defs/KeyRoleEnum",
          "description": "Key role: csk, ksk, or zsk"
        },
        "storage_type": {
          "anyOf": [
            {
              "$ref": "#/$defs/KeyStorageEnum"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Storage type: key-directory or key-store"
        },
        "key_store_name": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Name of key store (if storage_type is key-store)",
          "title": "Key Store Name"
        },
        "lifetime": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "string"
            },
            {
              "const": "unlimited",
              "type": "string"
            }
          ],
          "description": "Key lifetime or 'unlimited'",
          "title": "Lifetime"
        },
        "algorithm": {
          "anyOf": [
            {
              "$ref": "#/$defs/DnssecAlgorithmEnum"
            },
            {
              "type": "string"
            },
            {
              "type": "integer"
            }
          ],
          "description": "DNSSEC algorithm name or number",
          "title": "Algorithm"
        },
        "key_size": {
          "anyOf": [
            {
              "ge": 0,
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Key size in bits (optional, must be positive)",
          "title": "Key Size"
        },
        "tag_range": {
          "anyOf": [
            {
              "maxItems": 2,
              "minItems": 2,
              "prefixItems": [
                {
                  "type": "integer"
                },
                {
                  "type": "integer"
                }
              ],
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Valid key tag range [min, max]",
          "title": "Tag Range"
        }
      },
      "required": [
        "role",
        "lifetime",
        "algorithm"
      ],
      "title": "DnssecKeyEntry",
      "type": "object"
    },
    "KeyRoleEnum": {
      "description": "Key roles in DNSSEC policy.",
      "enum": [
        "csk",
        "ksk",
        "zsk"
      ],
      "title": "KeyRoleEnum",
      "type": "string"
    },
    "KeyStorageEnum": {
      "description": "Key storage types.",
      "enum": [
        "key-directory",
        "key-store"
      ],
      "title": "KeyStorageEnum",
      "type": "string"
    },
    "Nsec3ParamBlock": {
      "description": "NSEC3 parameters configuration.\n\nGrammar:\n```\nnsec3param [ iterations <integer> ] [ optout <boolean> ] [ salt-length <integer> ];\n```",
      "properties": {
        "comment": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Optional comment for this block",
          "title": "Comment"
        },
        "iterations": {
          "anyOf": [
            {
              "ge": 0,
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Number of hash iterations (default: 0)",
          "title": "Iterations"
        },
        "optout": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string"
            },
            {
              "type": "integer"
            },
            {
              "type": "number"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Enable opt-out (default: no)",
          "title": "Optout"
        },
        "salt_length": {
          "anyOf": [
            {
              "ge": 0,
              "le": 255,
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "description": "Salt length in bytes (default: 0)",
          "title": "Salt Length"
        }
      },
      "title": "Nsec3ParamBlock",
      "type": "object"
    }
  },
  "description": "DNSSEC key and signing policy (KASP) configuration block for BIND.\n\nBuilt-in policies: \"default\", \"insecure\", \"none\"\n\nGrammar:\n```\ndnssec-policy <string> {\n    cdnskey <boolean>;\n    cds-digest-types { <string>; ... };\n    dnskey-ttl <duration>;\n    inline-signing <boolean>;\n    keys { ... };\n    manual-mode <boolean>;\n    max-zone-ttl <duration>;\n    nsec3param [ ... ];\n    offline-ksk <boolean>;\n    parent-ds-ttl <duration>;\n    parent-propagation-delay <duration>;\n    publish-safety <duration>;\n    purge-keys <duration>;\n    retire-safety <duration>;\n    signatures-jitter <duration>;\n    signatures-refresh <duration>;\n    signatures-validity <duration>;\n    signatures-validity-dnskey <duration>;\n    zone-propagation-delay <duration>;\n};\n```",
  "properties": {
    "comment": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Optional comment for this block",
      "title": "Comment"
    },
    "name": {
      "description": "Name of the DNSSEC policy",
      "title": "Name",
      "type": "string"
    },
    "cdnskey": {
      "anyOf": [
        {
          "type": "boolean"
        },
        {
          "type": "string"
        },
        {
          "type": "integer"
        },
        {
          "type": "number"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Publish CDNSKEY records during KSK rollover",
      "title": "Cdnskey"
    },
    "inline_signing": {
      "anyOf": [
        {
          "type": "boolean"
        },
        {
          "type": "string"
        },
        {
          "type": "integer"
        },
        {
          "type": "number"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Maintain separate signed version of zone",
      "title": "Inline Signing"
    },
    "manual_mode": {
      "anyOf": [
        {
          "type": "boolean"
        },
        {
          "type": "string"
        },
        {
          "type": "integer"
        },
        {
          "type": "number"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Run key management in manual mode",
      "title": "Manual Mode"
    },
    "offline_ksk": {
      "anyOf": [
        {
          "type": "boolean"
        },
        {
          "type": "string"
        },
        {
          "type": "integer"
        },
        {
          "type": "number"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Sign DNSKEY/CDS/CDNSKEY RRsets offline",
      "title": "Offline Ksk"
    },
    "dnskey_ttl": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "TTL for DNSKEY records (default: 1h)",
      "title": "Dnskey Ttl"
    },
    "max_zone_ttl": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Maximum TTL for zone records (default: 24h)",
      "title": "Max Zone Ttl"
    },
    "parent_ds_ttl": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "TTL of DS RRset in parent zone (default: 1d)",
      "title": "Parent Ds Ttl"
    },
    "parent_propagation_delay": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Parent zone propagation delay (default: 1h)",
      "title": "Parent Propagation Delay"
    },
    "publish_safety": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Safety margin before key activation (default: 1h)",
      "title": "Publish Safety"
    },
    "purge_keys": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Time to keep deleted keys (default: 90d)",
      "title": "Purge Keys"
    },
    "retire_safety": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Safety margin after key deactivation (default: 1h)",
      "title": "Retire Safety"
    },
    "signatures_jitter": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Jitter range for signature expiration (default: 12h)",
      "title": "Signatures Jitter"
    },
    "signatures_refresh": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Signature refresh interval (default: 5d)",
      "title": "Signatures Refresh"
    },
    "signatures_validity": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Signature validity period (default: 2w)",
      "title": "Signatures Validity"
    },
    "signatures_validity_dnskey": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "DNSKEY signature validity period (default: 2w)",
      "title": "Signatures Validity Dnskey"
    },
    "zone_propagation_delay": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Zone propagation delay (default: 5m)",
      "title": "Zone Propagation Delay"
    },
    "cds_digest_types": {
      "anyOf": [
        {
          "items": {
            "$ref": "#/$defs/DnssecDigestTypeEnum"
          },
          "type": "array"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Digest types for CDS records (default: SHA-256 only)",
      "title": "Cds Digest Types"
    },
    "keys": {
      "anyOf": [
        {
          "items": {
            "$ref": "#/$defs/DnssecKeyEntry"
          },
          "type": "array"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Key specifications",
      "title": "Keys"
    },
    "nsec3param": {
      "anyOf": [
        {
          "$ref": "#/$defs/Nsec3ParamBlock"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "NSEC3 parameters (use NSEC3 instead of NSEC)"
    }
  },
  "required": [
    "name"
  ],
  "title": "DnssecPolicyBlock",
  "type": "object"
}

Fields:

comment (string_BIND | None)
name (string_BIND)
cdnskey (boolean_BIND | None)
inline_signing (boolean_BIND | None)
manual_mode (boolean_BIND | None)
offline_ksk (boolean_BIND | None)
dnskey_ttl (duration_BIND | None)
max_zone_ttl (duration_BIND | None)
parent_ds_ttl (duration_BIND | None)
parent_propagation_delay (duration_BIND | None)
publish_safety (duration_BIND | None)
purge_keys (duration_BIND | None)
retire_safety (duration_BIND | None)
signatures_jitter (duration_BIND | None)
signatures_refresh (duration_BIND | None)
signatures_validity (duration_BIND | None)
signatures_validity_dnskey (duration_BIND | None)
zone_propagation_delay (duration_BIND | None)
cds_digest_types (list[DnssecDigestTypeEnum] | None)
keys (list[DnssecKeyEntry] | None)
nsec3param (Nsec3ParamBlock | None)

Validators:

normalize_digest_types → cds_digest_types
validate_digest_types_format → cds_digest_types
validate_policy_consistency

name `pydantic-field` ¶

name: string_BIND

Name of the DNSSEC policy

cdnskey `pydantic-field` ¶

cdnskey: boolean_BIND | None = None

Publish CDNSKEY records during KSK rollover

inline_signing `pydantic-field` ¶

inline_signing: boolean_BIND | None = None

Maintain separate signed version of zone

manual_mode `pydantic-field` ¶

manual_mode: boolean_BIND | None = None

Run key management in manual mode

offline_ksk `pydantic-field` ¶

offline_ksk: boolean_BIND | None = None

Sign DNSKEY/CDS/CDNSKEY RRsets offline

dnskey_ttl `pydantic-field` ¶

dnskey_ttl: duration_BIND | None = None

TTL for DNSKEY records (default: 1h)

max_zone_ttl `pydantic-field` ¶

max_zone_ttl: duration_BIND | None = None

Maximum TTL for zone records (default: 24h)

parent_ds_ttl `pydantic-field` ¶

parent_ds_ttl: duration_BIND | None = None

TTL of DS RRset in parent zone (default: 1d)

parent_propagation_delay `pydantic-field` ¶

parent_propagation_delay: duration_BIND | None = None

Parent zone propagation delay (default: 1h)

publish_safety `pydantic-field` ¶

publish_safety: duration_BIND | None = None

Safety margin before key activation (default: 1h)

purge_keys `pydantic-field` ¶

purge_keys: duration_BIND | None = None

Time to keep deleted keys (default: 90d)

retire_safety `pydantic-field` ¶

retire_safety: duration_BIND | None = None

Safety margin after key deactivation (default: 1h)

signatures_jitter `pydantic-field` ¶

signatures_jitter: duration_BIND | None = None

Jitter range for signature expiration (default: 12h)

signatures_refresh `pydantic-field` ¶

signatures_refresh: duration_BIND | None = None

Signature refresh interval (default: 5d)

signatures_validity `pydantic-field` ¶

signatures_validity: duration_BIND | None = None

Signature validity period (default: 2w)

signatures_validity_dnskey `pydantic-field` ¶

signatures_validity_dnskey: duration_BIND | None = None

DNSKEY signature validity period (default: 2w)

zone_propagation_delay `pydantic-field` ¶

zone_propagation_delay: duration_BIND | None = None

Zone propagation delay (default: 5m)

cds_digest_types `pydantic-field` ¶

cds_digest_types: list[DnssecDigestTypeEnum] | None = None

Digest types for CDS records (default: SHA-256 only)

keys `pydantic-field` ¶

keys: list[DnssecKeyEntry] | None = None

Key specifications

nsec3param `pydantic-field` ¶

nsec3param: Nsec3ParamBlock | None = None

NSEC3 parameters (use NSEC3 instead of NSEC)

normalize_digest_types `pydantic-validator` ¶

normalize_digest_types(
    v: list[DnssecDigestTypeEnum] | None,
) -> list[DnssecDigestTypeEnum] | None

Normalize digest types to enum.

validate_digest_types_format `pydantic-validator` ¶

validate_digest_types_format(
    v: list[DnssecDigestTypeEnum] | None,
) -> list[str] | None

Convert digest types to proper BIND syntax.

validate_policy_consistency `pydantic-validator` ¶

validate_policy_consistency() -> DnssecPolicyBlock

Validate policy consistency.

"default", "insecure", and "none" are reserved policy names used to reference a built-in policy (e.g. dnssec-policy default; inside a zone) - they can never be declared as a dnssec-policy <name> { ... }; block, even with an empty body. named-checkconf rejects a bare dnssec-policy default; at the top level with "'{' expected near ';'", and rejects the braced form with "dnssec-policy name may not be 'insecure', 'none', or 'default'".

DnssecKeyEntry `pydantic-model` ¶

Bases: BindBaseModel

Key entry in dnssec-policy keys block.

Grammar:

( csk | ksk | zsk ) [ key-directory | key-store <string> ]
         lifetime <duration_or_unlimited> algorithm <string>
         [ tag-range <integer> <integer> ] [ <integer> ];

Show JSON schema:

{
  "$defs": {
    "DnssecAlgorithmEnum": {
      "description": "DNSSEC algorithms as defined by BIND.",
      "enum": [
        "rsamd5",
        "dh",
        "dsa",
        "rsasha1",
        "dsa-nsec3-sha1",
        "rsasha1-nsec3-sha1",
        "rsasha256",
        "rsasha512",
        "ecc-gost",
        "ecdsap256sha256",
        "ecdsap384sha384",
        "ed25519",
        "ed448"
      ],
      "title": "DnssecAlgorithmEnum",
      "type": "string"
    },
    "KeyRoleEnum": {
      "description": "Key roles in DNSSEC policy.",
      "enum": [
        "csk",
        "ksk",
        "zsk"
      ],
      "title": "KeyRoleEnum",
      "type": "string"
    },
    "KeyStorageEnum": {
      "description": "Key storage types.",
      "enum": [
        "key-directory",
        "key-store"
      ],
      "title": "KeyStorageEnum",
      "type": "string"
    }
  },
  "description": "Key entry in dnssec-policy keys block.\n\nGrammar:\n```\n( csk | ksk | zsk ) [ key-directory | key-store <string> ]\n         lifetime <duration_or_unlimited> algorithm <string>\n         [ tag-range <integer> <integer> ] [ <integer> ];\n```",
  "properties": {
    "comment": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Optional comment for this block",
      "title": "Comment"
    },
    "role": {
      "$ref": "#/$defs/KeyRoleEnum",
      "description": "Key role: csk, ksk, or zsk"
    },
    "storage_type": {
      "anyOf": [
        {
          "$ref": "#/$defs/KeyStorageEnum"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Storage type: key-directory or key-store"
    },
    "key_store_name": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Name of key store (if storage_type is key-store)",
      "title": "Key Store Name"
    },
    "lifetime": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "string"
        },
        {
          "const": "unlimited",
          "type": "string"
        }
      ],
      "description": "Key lifetime or 'unlimited'",
      "title": "Lifetime"
    },
    "algorithm": {
      "anyOf": [
        {
          "$ref": "#/$defs/DnssecAlgorithmEnum"
        },
        {
          "type": "string"
        },
        {
          "type": "integer"
        }
      ],
      "description": "DNSSEC algorithm name or number",
      "title": "Algorithm"
    },
    "key_size": {
      "anyOf": [
        {
          "ge": 0,
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Key size in bits (optional, must be positive)",
      "title": "Key Size"
    },
    "tag_range": {
      "anyOf": [
        {
          "maxItems": 2,
          "minItems": 2,
          "prefixItems": [
            {
              "type": "integer"
            },
            {
              "type": "integer"
            }
          ],
          "type": "array"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Valid key tag range [min, max]",
      "title": "Tag Range"
    }
  },
  "required": [
    "role",
    "lifetime",
    "algorithm"
  ],
  "title": "DnssecKeyEntry",
  "type": "object"
}

Fields:

comment (string_BIND | None)
role (KeyRoleEnum)
storage_type (KeyStorageEnum | None)
key_store_name (string_BIND | None)
lifetime (duration_BIND | Literal['unlimited'])
algorithm (DnssecAlgorithmEnum | string_BIND | int)
key_size (integer_BIND | None)
tag_range (tuple[integer_BIND, integer_BIND] | None)

Validators:

normalize_algorithm → algorithm
ensure_string_format → algorithm
validate_tag_range → tag_range

role `pydantic-field` ¶

role: KeyRoleEnum

Key role: csk, ksk, or zsk

storage_type `pydantic-field` ¶

storage_type: KeyStorageEnum | None = None

Storage type: key-directory or key-store

key_store_name `pydantic-field` ¶

key_store_name: string_BIND | None = None

Name of key store (if storage_type is key-store)

lifetime `pydantic-field` ¶

lifetime: duration_BIND | Literal['unlimited']

Key lifetime or 'unlimited'

algorithm `pydantic-field` ¶

algorithm: DnssecAlgorithmEnum | string_BIND | int

DNSSEC algorithm name or number

key_size `pydantic-field` ¶

key_size: integer_BIND | None = None

Key size in bits (optional, must be positive)

tag_range `pydantic-field` ¶

tag_range: tuple[integer_BIND, integer_BIND] | None = None

Valid key tag range [min, max]

normalize_algorithm `pydantic-validator` ¶

normalize_algorithm(
    v: DnssecAlgorithmEnum | string_BIND | int,
) -> DnssecAlgorithmEnum

Normalize algorithm to enum if possible.

ensure_string_format `pydantic-validator` ¶

ensure_string_format(
    v: DnssecAlgorithmEnum | string_BIND | int,
) -> str

Ensure algorithm is properly formatted for BIND.

Nsec3ParamBlock `pydantic-model` ¶

Bases: BindBaseModel

NSEC3 parameters configuration.

Grammar:

nsec3param [ iterations <integer> ] [ optout <boolean> ] [ salt-length <integer> ];

Show JSON schema:

{
  "description": "NSEC3 parameters configuration.\n\nGrammar:\n```\nnsec3param [ iterations <integer> ] [ optout <boolean> ] [ salt-length <integer> ];\n```",
  "properties": {
    "comment": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Optional comment for this block",
      "title": "Comment"
    },
    "iterations": {
      "anyOf": [
        {
          "ge": 0,
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Number of hash iterations (default: 0)",
      "title": "Iterations"
    },
    "optout": {
      "anyOf": [
        {
          "type": "boolean"
        },
        {
          "type": "string"
        },
        {
          "type": "integer"
        },
        {
          "type": "number"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Enable opt-out (default: no)",
      "title": "Optout"
    },
    "salt_length": {
      "anyOf": [
        {
          "ge": 0,
          "le": 255,
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Salt length in bytes (default: 0)",
      "title": "Salt Length"
    }
  },
  "title": "Nsec3ParamBlock",
  "type": "object"
}

Fields:

comment (string_BIND | None)
iterations (integer_BIND | None)
optout (boolean_BIND | None)
salt_length (integer_BIND | None)

iterations `pydantic-field` ¶

iterations: integer_BIND | None = None

Number of hash iterations (default: 0)

optout `pydantic-field` ¶

optout: boolean_BIND | None = None

Enable opt-out (default: no)

salt_length `pydantic-field` ¶

salt_length: integer_BIND | None = None

Salt length in bytes (default: 0)

DnssecAlgorithmEnum ¶

Bases: str, Enum

DNSSEC algorithms as defined by BIND.

from_value `classmethod` ¶

from_value(value: str | int) -> DnssecAlgorithmEnum

Convert string or numeric algorithm to enum.

DnssecDigestTypeEnum ¶

Bases: str, Enum

DNSSEC digest types for CDS records.

KeyRoleEnum ¶

Bases: str, Enum

Key roles in DNSSEC policy.

KeyStorageEnum ¶

Bases: str, Enum

Key storage types.

DNSSEC Policy¶

DnssecPolicyBlock pydantic-model ¶

name pydantic-field ¶

cdnskey pydantic-field ¶

inline_signing pydantic-field ¶

manual_mode pydantic-field ¶

offline_ksk pydantic-field ¶

dnskey_ttl pydantic-field ¶

max_zone_ttl pydantic-field ¶

parent_ds_ttl pydantic-field ¶

parent_propagation_delay pydantic-field ¶

publish_safety pydantic-field ¶

purge_keys pydantic-field ¶

retire_safety pydantic-field ¶

signatures_jitter pydantic-field ¶

signatures_refresh pydantic-field ¶

signatures_validity pydantic-field ¶

signatures_validity_dnskey pydantic-field ¶

zone_propagation_delay pydantic-field ¶

cds_digest_types pydantic-field ¶

keys pydantic-field ¶

nsec3param pydantic-field ¶

normalize_digest_types pydantic-validator ¶

validate_digest_types_format pydantic-validator ¶

validate_policy_consistency pydantic-validator ¶

DnssecKeyEntry pydantic-model ¶

role pydantic-field ¶

storage_type pydantic-field ¶

key_store_name pydantic-field ¶

lifetime pydantic-field ¶

algorithm pydantic-field ¶

key_size pydantic-field ¶

tag_range pydantic-field ¶

normalize_algorithm pydantic-validator ¶

ensure_string_format pydantic-validator ¶

Nsec3ParamBlock pydantic-model ¶

iterations pydantic-field ¶

optout pydantic-field ¶

salt_length pydantic-field ¶

DnssecAlgorithmEnum ¶

from_value classmethod ¶

DnssecDigestTypeEnum ¶

KeyRoleEnum ¶

KeyStorageEnum ¶

DnssecPolicyBlock `pydantic-model` ¶

name `pydantic-field` ¶

cdnskey `pydantic-field` ¶

inline_signing `pydantic-field` ¶

manual_mode `pydantic-field` ¶

offline_ksk `pydantic-field` ¶

dnskey_ttl `pydantic-field` ¶

max_zone_ttl `pydantic-field` ¶

parent_ds_ttl `pydantic-field` ¶

parent_propagation_delay `pydantic-field` ¶

publish_safety `pydantic-field` ¶

purge_keys `pydantic-field` ¶

retire_safety `pydantic-field` ¶

signatures_jitter `pydantic-field` ¶

signatures_refresh `pydantic-field` ¶

signatures_validity `pydantic-field` ¶

signatures_validity_dnskey `pydantic-field` ¶

zone_propagation_delay `pydantic-field` ¶

cds_digest_types `pydantic-field` ¶

keys `pydantic-field` ¶

nsec3param `pydantic-field` ¶

normalize_digest_types `pydantic-validator` ¶

validate_digest_types_format `pydantic-validator` ¶

validate_policy_consistency `pydantic-validator` ¶

DnssecKeyEntry `pydantic-model` ¶

role `pydantic-field` ¶

storage_type `pydantic-field` ¶

key_store_name `pydantic-field` ¶

lifetime `pydantic-field` ¶

algorithm `pydantic-field` ¶

key_size `pydantic-field` ¶

tag_range `pydantic-field` ¶

normalize_algorithm `pydantic-validator` ¶

ensure_string_format `pydantic-validator` ¶

Nsec3ParamBlock `pydantic-model` ¶

iterations `pydantic-field` ¶

optout `pydantic-field` ¶

salt_length `pydantic-field` ¶

from_value `classmethod` ¶