Welcome to OpenDNSSEC

The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security.

The latest news about OpenDNSSEC can be found below!

OpenDNSSEC 2.0.1

Version 2.0.1 of OpenDNSSEC has been released on 2016-07-21.


This release is primarily focused on ironing out the issues on the migration path from 1.4 to 2.0. Besides that there are no functional changes.


  • Fixed crash and linking issue in ods-migrate.
  • Fixed case where 2.0.0 could not read backup files from 1.4.10.
  • Fixed bug in migration script where key state in the database wasn’t transformed properly.


OpenDNSSEC 2.0.0

It gives us pleasure to announce the release of OpenDNSSEC 2.0

OpenDNSSEC got a entire re-write of the enforcer. This part of OpenDNSSEC controls changing signing keys in the right way to perform a roll-over. Before, the enforcer would perform a roll-over according to a strict paradigm. One scenario in which deviations would not be possible.

The new enforcer is more aware of the zone changes being propagated in the Internet. It can therefore decide when it is safe to make changes, rather than to rely upon a given scenario. This makes it possible now for OpenDNSSEC to:

  • Allow changing your TTL values and all other related parameters in your key and signing policy (KASP). OpenDNSSEC will know which outdated records may still be on the Internet due to their TTL and only roll when it is safe.
  • It is possible to safely roll to an unsigned situation, without going bogus.
  • Perform a roll-over procedure at any time, even if a roll-over procedure is still in progress, this way you can abort a roll-over and perform emergency roll-overs.
  • Perform a roll-over to a different signing algorithm. DNSSEC requires the algorithm number of ZSK and KSK to be the same, so a roll-over to a different algorithm requires a different sequence.
  • Since there is no longer a single scenario, it will become possible to perform other roll-over methods, like a double DS roll-over or a double RRSIG roll-over.

These features keep your zone valid even in situations where changing parameters could trap you into a bogus situation. OpenDNSSEC chooses the fastest safe steps to keep (or even heal) your zone. Other features have also been realized in this rewrite:

  • Shared keys, allowing multiple zones to share the most recent signing key for that policy. Useful when having many zones, and a limited storage in your HSM.
  • Combined keys, allow KSK and ZSK to be the same key, also limiting the usage of keys, but also simplify key usage.
  • Also allow zones to pass unsigned. This allows for a chain of software packages where both signed and unsigned zones can follow the same steps in your chain, simplifying the set-up.
  • And the enforcer no longer requires to be run periodically, but runs as a proper daemon which wakes up at the proper time.
  • Allow for multiple HSMs, also allowing you to roll to roll your zone from keys in one HSM to another. Or to store KSK and ZSK separately.
  • This could even be used in set-ups where the key set is signed separately from your zone.
  • And the enforcer daemon can now be queried and given commands using command line channel.

Administratively, there has also been a major change. NLnet Labs has adopted the full development of OpenDNSSEC, where previously it was one of the partners in the project. This ensures a future-safe continued development of OpenDNSSEC. In this respect we will see more features enhancements in quicker release cycles soon.

Some heads-up when trying it out after being used to 1.4:

  • Scripted migration from 1.4 to 2.0 is available, see MIGRATION file
  • Use command ods-enforcer-db-setup rather than “ods-ksmutil setup”
  • Any other use of ods-ksmutil is replaced with the ods-enforcer command, which at the moment requires the enforcer daemon to be running
  • Use ods-enforcer zone add and delete rather than modifying the zonelist.xml file yourself. This file is not kept up-to-date automatically anymore
  • to start using OpenDNSSEC, use ods-enforcer policy import instead of update kasp to update your policies
  • Getting started at: Quick start guide.

Edit: Update from 2.0.0 to 2.0.0-1. Both releases are identical but 2.0.0 lacked some database generation scripts required for migration from 1.4.10.

Download it here:

OpenDNSSEC 1.4.10

Version 1.4.10 of OpenDNSSEC has been released on May 2nd, 2016.


This release fix targets stability issues which have had a history nad had been hard to reproduce.  Stability should be improved, running OpenDNSSEC as a long term service.

Changes in TTL in the input zone that seem not to be propagated, notifies to slaves under load that where not handled properly and could lead to assertions.  NSEC3PARAM that would appear duplicate in the resulting zone, and crashes in the signer daemon in seldom race conditions or re-opening due to a HSM reset.

No migration steps needed when upgrading from OpenDNSSEC 1.4.9.

Also have a look at our OpenDNSSEC 2.0 beta release, its impending release will help us forward with new development and signal phasing out historic releases.


  • SUPPORT-156 OPENDNSSEC-771: Multiple NSEC3PARAM records in signed zone.
    After a resalt the signer would fail to remove the old NSEC3PARAM RR until a manual resign or incoming transfer.
    Old NSEC3PARAMS are removed when inserting a new record, even if they look the same.
  • OPENDNSSEC-725: Signer did not properly handle new update while still distributing notifies to slaves.
    An AXFR disconnect looked not to be handled gracefully.
  • SUPPORT-171: Signer would sometimes hit an assertion using DNS output adapter when .ixfr was missing or corrupt but .backup file available.
  • Above two issues also in part addresses problems with seemingly corrected backup files (SOA serial). Also an crash on badly configured DNS output adapters is averted.
  • The signer daemon will now refuse to start when failed to open a listen socket for DNS handling.
  • OPENDNSSEC-478 OPENDNSSEC-750 OPENDNSSEC-581 OPENDNSSEC-582 SUPPORT-88: Segmentation fault in signer daemon when opening and closing hsm multiple times.
    Also addresses other concurrency access by avoiding a common context to the HSM (a.k.a. NULL context).
  • OPENDNSSEC-798: Improper use of key handles across hsm reopen, causing keys not to be available after a re-open.
  • SUPPORT-186: IXFR disregards TTL changes, when only TTL of an RR is changed.
    TTL changes should be treated like any other changes to records.
  • When OpenDNSSEC now overrides a TTL value, this is now reported in the log files.