Do you want to check the DNSSEC status of a large number of domains? To know whether they are signed or unsigned? Or perhaps if any of the domains are failing validation?
Yesterday at the DNSSEC Deployment Workshop at ICANN 45 in Toronto I learned that the good folks at SIDN Labs in the Netherlands have created a service that allows you to do just that… and they are offering it for free public usage.
They provide two ways to use the service: 1) a web interface where you upload a file; or 2) a RESTful API you can query. The web interface is in Dutch, but for non-Dutch-speakers it’s not hard to figure out (or translate via browsers):
You just upload a file and the service will give you back the results of whether the domains are secure, insecure or failing validation (‘bogus’).
What was more interesting to me, though, was the RESTful API allowing you to query the status of a domain by simply connecting to:
http://check.sidnlabs.nl:8080/check/domainname
as in:
The comma-separated results that come back are:
internetsociety.org,"",secure,""
with the third field being either “secure”, “insecure” or “bogus”.
My immediate thought was how I could use this to create a simple little program to help me remember which of my domains I have signed and which ones I still need to sign. After playing around with it for a few minutes in python, I decided that others might find my experiments useful or interesting, so I uploaded them to a Github repository at:
https://github.com/Deploy360/dnssec-portfolio-checker-examples
I included one very simple example that does no error checking and simply issues queries based on a list in the program. I then added a second example that you could use from a command line to query for one or more domains:
python dnssec-check.py internetsociety.org ietf.org dnssec-failed.org
(Omitting the ‘python’, of course, if you change ‘dnssec-check.py’ to be executable.) An obvious extension would be to make the program accept the name of a file containing domain names. You could also change it so that “bogus” entries come out on top or have big “Danger! Danger!” warnings of some type. I may make a web page that when I go to it shows me visually which of my domains are signed and which aren’t. There’s a hundred other things you could do with it. My purpose was just to try it out and see how the API worked.
Feel free to use those examples in whatever way you want… and thanks to SIDN Labs for making this service available for any of us to use!