{"id":20564278,"url":"https://github.com/nlnetlabs/dnssec-trigger","last_synced_at":"2026-03-04T11:31:04.996Z","repository":{"id":75968575,"uuid":"94198928","full_name":"NLnetLabs/dnssec-trigger","owner":"NLnetLabs","description":"Dnssec trigger enables the end-host to use DNSSEC protection for the DNS traffic.","archived":false,"fork":false,"pushed_at":"2023-07-25T15:07:29.000Z","size":1737,"stargazers_count":25,"open_issues_count":7,"forks_count":9,"subscribers_count":14,"default_branch":"master","last_synced_at":"2025-04-21T15:45:04.438Z","etag":null,"topics":["dns","dnssec"],"latest_commit_sha":null,"homepage":"https://nlnetlabs.nl/projects/dnssec-trigger/","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/NLnetLabs.png","metadata":{"files":{"readme":"README","changelog":"Changelog","contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":["NLnetLabs"],"custom":["https://nlnetlabs.nl/funding/"]}},"created_at":"2017-06-13T10:04:51.000Z","updated_at":"2024-11-05T00:09:54.000Z","dependencies_parsed_at":null,"dependency_job_id":"454098a1-269a-45af-9f02-57482a377b09","html_url":"https://github.com/NLnetLabs/dnssec-trigger","commit_stats":null,"previous_names":[],"tags_count":19,"template":false,"template_full_name":null,"purl":"pkg:github/NLnetLabs/dnssec-trigger","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NLnetLabs%2Fdnssec-trigger","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NLnetLabs%2Fdnssec-trigger/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NLnetLabs%2Fdnssec-trigger/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NLnetLabs%2Fdnssec-trigger/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/NLnetLabs","download_url":"https://codeload.github.com/NLnetLabs/dnssec-trigger/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NLnetLabs%2Fdnssec-trigger/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30078976,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-04T08:01:56.766Z","status":"ssl_error","status_checked_at":"2026-03-04T08:00:42.919Z","response_time":59,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dns","dnssec"],"created_at":"2024-11-16T04:25:12.560Z","updated_at":"2026-03-04T11:31:04.512Z","avatar_url":"https://github.com/NLnetLabs.png","language":"C","funding_links":["https://github.com/sponsors/NLnetLabs","https://nlnetlabs.nl/funding/"],"categories":[],"sub_categories":[],"readme":"Dnssec Trigger Readme\n\nBy Wouter Wijngaards, NLnet Labs, 2011\nBSD license is in the LICENSE file.\nBugs or comments: labs@nlnetlabs.nl\n\nTo install see the INSTALL instructions file.\n\nIntro\n-----\n\nThis package contains the dnssec-trigger tools.  It works together with\na local validating resolver (unbound) and keeps DNSSEC enabled.  It does\nso by selecting DNSSEC enabled upstream caches or servers for unbound\nto talk to and by modifying the DNS path on the system to 127.0.0.1.\nIf DNSSEC does not work because of middleboxes, the insecure option\n(after a dialog window for the user) causes the DNS path to be set to\nthe insecure servers.\n\nThe main components are the daemon, DHCP-hooks, and a GUI-panel.\nThe daemon starts at bootup and runs in the background.  The DHCP hooks\ntell the daemon, these are sometimes scripts depending on the system.\nThe GUI-panel shows a tray icon notification applet.  The GUI panel shows\nthe dialog to the user if insecure is the only option.  The GUI panel\nhas a Reprobe button, so after sigon for the hotspot the user can retry\n(it makes the red ! disappear if it works).\n\nApplications can then trust responses with the AD flag from 127.0.0.1.\nBut they should know that sometimes the resolv.conf contains 'bad'\ninsecure servers (not 127.0.0.1) and then they must not trust the AD\nflag from them (and may need to send the query without the DO flag\nto fallback).  Responses asked with DO flag to 127.0.0.1 and with the\nreturned AD flag can then be trusted.  Trusted DNS responses may help\nwith DANE.\n\nThe dnssec-trigger package thus runs alongside the unbound daemon.  It\nprovides the user with the option to go to Insecure.  It selects DNSSEC\nservice where possible.  This helps people run DNSSEC.\n\n\nNormal usage\n------------\n\nThe user logs in and sees a status icon in the tray.  Most of the time\nit displays no ! (exclamation) but is quiet.  The icon can be ignored.\n\nWhen the user connects to a new network, the DHCP hooks notify the\ndnssec-trigger daemon.  This probes the network, and notifies unbound.\nThe user sees no change and continues to ignore the icon, unless there\nis no DNSSEC.\n\nIf the daemon probe fails to find DNSSEC capability, it tells unbound\nto stop talking to the network, and tells the statusicon to ask the user.\nA dialog pops up out of the tray icon.  If insecure, then the resolv.conf\nis changed to the insecure servers, unbound is inactive (loops to\n127.0.0.127).  The user can work normally on this network connection.\n\nFor a hotspot, the probe would fail (after a second or two), then with\ninsecure mode the user can login to the hotspot.  With Reprobe menu\nitem the user can reprobe dnssec and if it works then (many hotspots\nprovide good access once logged in) the icon is restored to safe.  The\nscripts would also reprobe on a DHCP change.\n\n\nOperations on Platforms\n-----------------------\n\nHow the different platforms operate is described here.\n\n* Security\n\nThere used to be a race condition where DHCP info briefly overriddes\nthe secure version, but this was fixed in 0.6.\n\n* unix - NetworkManager\n\nIn /etc/NetworkManager/dispatcher.d a script sends DHCP changes to\nthe daemon.  The script is a networkmanager dhcp hook script and uses\ndnssec-trigger-control to talk to the daemon.  The script uses nmcli\nto find the DNS info.\n\nGTK user interface.  In /etc/xdg/autostart/ a .desktop entry starts\nthe user-side tray icon (dnssec-trigger-panel).  The daemon is started\nfrom /etc/rc.d like regular daemons.  The tray icon communicates with\nthe daemon over a persistent SSL connection over loopback (127.0.0.1).\nIt is possible to have multiple tray icons connected over SSL.\n\n* unix - Netconfig\n\nIn /etc/netconfig.d a script sends DHCP changes to the daemon.  It greps\nthe info out of /var/run/netconfig/* files.  It sends with\ndnssec-trigger-control to the daemon.\n\nGTK like networkmanager.\n\n* OSX\n\nIn /Library/LaunchDaemons two plist files exist.  One starts the daemon.\nThe other watches the /Library/Preferences/SystemConfiguration for changes\nand launches a script.  This script uses ifconfig and parses plist files\nand then sends the results with dnssec-trigger-control to the daemon.\n\nThe daemon changes resolv.conf but does not need to as on OSX it also\nsets the network preferences for the network interfaces to the values.\nThese preferences survive a reboot, so the reboot is safe. There then\nis no connection until unbound is started during reboot.\n\nIn /Library/LaunchAgents a plist file starts the tray icon (Cocoa app).\nIt uses an SSL connection to the daemon over loopback (127.0.0.1).\n\n* Windows\n\nThe daemon is a service.  It has a thread that listens to network changes\nand blocks on that, it notifies the main daemon when there is a change.\nThe DHCP DNS servers are picked from the registry and the override DNS\noptions are put in the registry as the network preferences.  These survive\na reboot, so that the system is safe during a reboot.  There then is no\nDNS connection until unbound is started during reboot.\n\nThe tray icon is a native application.  It uses SSL to talk to the daemon.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnlnetlabs%2Fdnssec-trigger","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnlnetlabs%2Fdnssec-trigger","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnlnetlabs%2Fdnssec-trigger/lists"}