This is pretty much DNS spoofing on local network including DNSSEC, but I believe it should be somehow possible since I'm the legitimate owner of the domain.
I'm planning to provide a service during 1-2 day events. The service will be available to visitors on a local wifi network, which, however, can't be connected to the Internet. I'd like it to be available using a domain (let's use example.com.
), but I'd also like to achieve that if you connect to that domain from outside (e.g. mobile data by accident), it shows a different, cloud-hosted web page.
This is my thought how it should be possible, but I'm new to DNSSEC, so I'd like to verify if I'm not missing something.
I create a single Key-signing key, which I use to create public DNS records hosted at (
ns.example.com
). Via my registrar, I upload the NS record, DS record and glue records with the IP of the public nameserver to thecom.
registry.I host my own DNS server on the local network.
I configure the DHCP server on the local network to provide the IP address of that local DNS server as the default DNS resolver.
Before the event, I populate the DNS server config with fresh "partial" zone files of root and
com.
(by making queries for needed records and saving the outputs)Finally, I create and upload a set of DNS records for
example.com.
to be used in the local network, signed with the same KSK as the public records.
Questions:
Am I making some big mistake in my thought process above? Would this setup work? Can I host authoritative-like zones on a different nameserver than the SOA/NS specify?
Is it unsafe/bad to modify the NS records in "parent zones" (
com. IN NS
in root zone,example.com. IN NS
incom.
zone)? They aren't signed, they are only signed in "themselves"What about glue records (A record for
ns.example.com.
in thecom.
zone to prevent circular dependency)? Those don't seem to be signed eitherWhat all records do I need to fetch in pt. 4? Obviously SOA, DS, and respective RRSIGs for
com.
/example.com.
, but anything else?(Bonus question): Are there DNS hosting services allowing uploading custom private keys/RRSIGs, or do I need to setup my own nameserver in pt. 1? (It seems that the public records don't need to be hosted on
ns.example.com.
- the NS record forexample.com.
incom.
zone isn't signed, so I can replace it and add a glue record. Then the self-NS record inexample.com.
can be changed as I have the key for the zone)