{"id":18672439,"url":"https://github.com/chrj/prometheus-dnssec-exporter","last_synced_at":"2025-08-05T09:26:17.803Z","repository":{"id":45254154,"uuid":"151555444","full_name":"chrj/prometheus-dnssec-exporter","owner":"chrj","description":"DNSSEC Exporter for Prometheus","archived":false,"fork":false,"pushed_at":"2023-07-04T09:21:13.000Z","size":32,"stargazers_count":9,"open_issues_count":3,"forks_count":6,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-19T09:44:03.164Z","etag":null,"topics":["dnssec","go","prometheus"],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/chrj.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-10-04T10:36:36.000Z","updated_at":"2024-09-09T10:02:41.000Z","dependencies_parsed_at":"2024-06-19T06:17:50.968Z","dependency_job_id":"0a23dd61-0f48-43f4-9c3b-3583a01d683e","html_url":"https://github.com/chrj/prometheus-dnssec-exporter","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/chrj/prometheus-dnssec-exporter","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chrj%2Fprometheus-dnssec-exporter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chrj%2Fprometheus-dnssec-exporter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chrj%2Fprometheus-dnssec-exporter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chrj%2Fprometheus-dnssec-exporter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/chrj","download_url":"https://codeload.github.com/chrj/prometheus-dnssec-exporter/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chrj%2Fprometheus-dnssec-exporter/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":268869790,"owners_count":24320881,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-05T02:00:12.334Z","response_time":2576,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dnssec","go","prometheus"],"created_at":"2024-11-07T09:11:24.827Z","updated_at":"2025-08-05T09:26:17.739Z","avatar_url":"https://github.com/chrj.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# DNSSEC Exporter for Prometheus\n\nCheck for validity and expiration in DNSSEC signatures and expose metrics for Prometheus\n\n## Installation\n\n    $ go get -u github.com/chrj/prometheus-dnssec-exporter\n\n## Usage\n\n    Usage of prometheus-dnssec-exporter:\n      -config string\n        \tConfiguration file (default \"/etc/dnssec-checks\")\n      -listen-address string\n        \tPrometheus metrics port (default \":9204\")\n      -resolvers string\n        \tResolvers to use (comma separated) (default \"8.8.8.8:53,1.1.1.1:53\")\n      -timeout duration\n        \tTimeout for network operations (default 10s)\n\n## Metrics\n\n### Gauge: `dnssec_zone_record_days_left`\n\nNumber of days the signature will be valid.\n\nLabels:\n\n* `zone`\n* `record`\n* `type`\n\nIf more than one resolver is configured, the metric will be calculated from the\nresolver that is configured first.  If more than one RRSIG covers the record,\nthe number of days until the first one expires will be returned.  If the record\nis not signed of the signature cannot be validated, this metric will contain a\nbogus timestamp.\n\n### Gauge: `dnssec_zone_record_earliest_rrsig_expiry`\n\nEarliest expiring RRSIG covering the record on resolver in unixtime.\n\nLabels:\n\n* `resolver`\n* `zone`\n* `record`\n* `type`\n\nIf more than one RRSIG covers the record, the expiration time returned will be\nof the one that expires earliest.  If the record does not resolve or cannot be\nvalidated, this metric will be absent.\n\n### Gauge: `dnssec_zone_record_resolves`\n\nDoes the record resolve using the specified DNSSEC enabled resolvers.\n\nLabels:\n\n* `resolver`\n* `zone`\n* `record`\n* `type`\n\nThis metric will return 1 only if the record resolves **and** validates.\n\n### Examples\n\n    # HELP dnssec_zone_record_days_left Number of days the signature will be valid\n    # TYPE dnssec_zone_record_days_left gauge\n    dnssec_zone_record_days_left{record=\"@\",type=\"SOA\",zone=\"ietf.org\"} 320.3333333333333\n    dnssec_zone_record_days_left{record=\"@\",type=\"SOA\",zone=\"verisigninc.com\"} 9.333333333333334\n    # HELP dnssec_zone_record_resolves Does the record resolve using the specified DNSSEC enabled resolvers\n    # TYPE dnssec_zone_record_resolves gauge\n    dnssec_zone_record_resolves{record=\"@\",resolver=\"1.1.1.1:53\",type=\"SOA\",zone=\"ietf.org\"} 1\n    dnssec_zone_record_resolves{record=\"@\",resolver=\"1.1.1.1:53\",type=\"SOA\",zone=\"verisigninc.com\"} 1\n    dnssec_zone_record_resolves{record=\"@\",resolver=\"8.8.8.8:53\",type=\"SOA\",zone=\"ietf.org\"} 1\n    dnssec_zone_record_resolves{record=\"@\",resolver=\"8.8.8.8:53\",type=\"SOA\",zone=\"verisigninc.com\"} 1\n    # HELP dnssec_zone_record_earliest_rrsig_expiry Earliest expiring RRSIG covering the record on resolver in unixtime\n    # TYPE dnssec_zone_record_earliest_rrsig_expiry gauge\n    dnssec_zone_record_earliest_rrsig_expiry{record=\"@\",resolver=\"1.1.1.1:53\",type=\"SOA\",zone=\"ietf.org\"} 1.664872679e+09\n    dnssec_zone_record_earliest_rrsig_expiry{record=\"@\",resolver=\"1.1.1.1:53\",type=\"SOA\",zone=\"verisigninc.com\"} 1.664778306e+09\n    dnssec_zone_record_earliest_rrsig_expiry{record=\"@\",resolver=\"8.8.8.8:53\",type=\"SOA\",zone=\"ietf.org\"} 1.664872679e+09\n    dnssec_zone_record_earliest_rrsig_expiry{record=\"@\",resolver=\"8.8.8.8:53\",type=\"SOA\",zone=\"verisigninc.com\"} 1.664778306e+09\n\n## Configuration\n\nSupply a configuration file path with `-config` (optionally, defaults to `/etc/dnssec-checks`). Uses [TOML](https://github.com/toml-lang/toml).\n\n[Sample configuration file](config.sample)\n\n## Prometheus target\n\nSupply a listen address with `-addr` (optionally, defaults to `:9204`), and configure a Prometheus job:\n\n    - job_name: \"dnssec\"\n      scrape_interval: \"1m\"\n      static_configs:\n        - targets:\n            - \"server:9204\"\n\n## Prometheus alert\n\nThe real benefit is getting an alert triggered when a signature is nearing expiration or is not longer valid. Check this [sample alert definition](dnssec.rules).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchrj%2Fprometheus-dnssec-exporter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fchrj%2Fprometheus-dnssec-exporter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchrj%2Fprometheus-dnssec-exporter/lists"}