{"id":22114024,"url":"https://github.com/plinss/bindtool","last_synced_at":"2025-07-25T08:31:14.514Z","repository":{"id":151659791,"uuid":"76295645","full_name":"plinss/bindtool","owner":"plinss","description":"Preprocessor for bind9 zone files","archived":false,"fork":false,"pushed_at":"2024-01-23T18:09:57.000Z","size":167,"stargazers_count":21,"open_issues_count":1,"forks_count":4,"subscribers_count":7,"default_branch":"main","last_synced_at":"2024-01-23T19:28:28.183Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/plinss.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2016-12-12T21:08:07.000Z","updated_at":"2024-01-23T19:28:40.907Z","dependencies_parsed_at":null,"dependency_job_id":"f070d6ff-c88d-42c4-a33a-eb2c9680b2cf","html_url":"https://github.com/plinss/bindtool","commit_stats":null,"previous_names":[],"tags_count":11,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plinss%2Fbindtool","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plinss%2Fbindtool/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plinss%2Fbindtool/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plinss%2Fbindtool/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/plinss","download_url":"https://codeload.github.com/plinss/bindtool/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":227544348,"owners_count":17785198,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-01T11:08:24.106Z","updated_at":"2025-07-25T08:31:14.484Z","avatar_url":"https://github.com/plinss.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# bindtool\n\nPreprocessor for bind9 zone files.\n\nThis tool is useful for managing zone files for a bind9 DNS server.\nIt provides basic variable substitutions and automatic generation of several kinds of DNS records, in particular, those based on external resources, like public keys.\nThis greatly simplifies keeping DNS zones current when keys change as no zone files need to be edited.\n\n\n## Installation\n\nRequires Python 3.9+.\n\n    sudo pip3 install bindtool\n\nOptionally create a virtual environment and install there.\n\nFor support reading DNS records from LDAP, you'll need to install the ldap module as well, either:\n\n    sudo pip3 install 'bindtool[ldap]'\n\nor:\n\n    sudo pip3 install python-ldap\n\n\n### Configuration\n\nThe example configuration file lists all possible options and their defaults.\nOnly values that are different from the defaults need to be present.\n\nThe configuration file `bindtool.json` may be placed in the current working directory,\nin /etc/bindtool,\nor in the same directory as the bindtool tool is installed in.\nA different configuration file name may be specified on the command line.\nIf the specified file name is not an absolute path,\nit will be searched for in the same locations,\ne.g. `bindtool --config config.json` will load `./config.json`, `/etc/bindtool/config.json`, or `\u003cinstall-dir\u003e/config.json`.\nThe file must adhere to standard JSON format.\n\nZone-specific config files may be placed along side the config file with the name `bindtoool.\u003czone-name\u003e.json`.\nIf present, values in a zone-specific config file will override those in the config file when processing that zone.\n\n#### Defaults\n\nThe `defaults` section specifies the default values for all of the arguments for the various record commands.\n\nFor example, to change the default `expire` value for SOA records::\n\n    \"defaults\": {\n        \"soa\": {\n            \"expire\": \"7d\",\n        }\n    },\n    ...\n\n\n#### LDAP\n\nThe `ldap` section specifies the connection and search paramaters for LDAP records.\n\n#### Directories\n\nThe `directories` section specifies the directories to find various file types in.\n\nDirectory values may include Python format strings for variable substitution.\nAll directory types accept the {name} field.\nCertificate and private key directories also accept the {key_type}, {suffix}, and {username} fields.\nThe dkim directory accepts the {selector} and {domain} fields.\n\n\n#### Key Type Suffixes\n\nEach certificate and key file will have a suffix, just before the file extension,\nindicating the type of key the file is for.\n\nThe default suffix used for each key type can be overridden in the `key_type_suffixes` section.\nIf you are only using a single key type, or want to omit the suffix from one key type,\nset it to an empty string.\nNote that if using multiple key types the suffix must be unique or files will be overridden.\n\n\n#### File Names\n\nAll output file names can be overridden using standard Python format strings.\nAll file name types accept the {name} field.\nCertificate and private key file names also accept the {key_type}, {suffix}, and {username} fields.\nThe dkim file name accepts the {selector} and {domain} fields.\n\n\n## Usage\n\nRun the command:\n\n    bindtool \u003czone-file\u003e [\u003coutput-directory-or-file\u003e]\n\nThe tool will process the source zone file and output a zone file ready for use by the DNS server.\n\nIt is best to keep the source zone files in a different directory than the DNS server uses for its zone files.\nFor example, keep the source files in `/etc/bind/zones` and configure the DNS server to load the zone files from `/var/cache/bind`.\nWhen making changes to a zone, edit the file in `/etc/bind/zones`, remove the server's journal file, and run the command:\n\n    bindtool /etc/bind/zones/myzone.com /var/cache/bind\n\nThe script `reload-zone.sh` (provided in this repository) can be used to automate this process as well as reconfigure and restart the DNS server upon a successful run.\n\n\n## Variable Substitution\n\nIn the source file variables can be declared via the following syntax:\n\n    {{name=value}}\n\nand substituted via:\n\n    {{name}}\n\nFor example:\n\n    {{ip4=192.0.2.0}}\n\n    @   A   {{ip4}}\n    www A   {{ip4}}\n\nbecomes:\n\n    @   A   192.0.2.0\n    www A   192.0.2.0\n\nVariables are available for use at any point after their declaration.\n\n\n## Include Files\n\nAdditional source files can be included via the following syntax:\n\n    {{include:file_path:local_variable=value:...}}\n\nThe file found at `file_path` will be included in the output as though the contents of that file were included inline.\nThe file path is will be searched for relative to the path of the file containing the `include` command, the primary zone file, or the configured `include` directory.\nInclude files can include additional files.\nThe file path may contain standard glob patterns, all files matching the pattern will be included.\nVariables defined in an include file are available for use in the file containing the `include` command at any point after the `include`.\n\nAdditional named arguments may follow the include file path,\nthese will define local variables available only inside the included file or files included by that file.\nLocal variables will override normal variables with the same name.\n\n\n## Record Generation\n\nThe tool can also automatically generate the several kinds of resource records.\nThe format for these records is:\n\n    {{type:arg1:arg2:arg3}}\n\nOptional arguments my be omitted, however if all arguments are omitted, at least one colon must follow the record type to distinguish it from a variable.\nArguments may also be specified by name in order to skip optional arguments, e.g.:\n\n    {{tlsa:443:ttl=300}}\n\nIf an argument value needs to contain a colon, equals sign, or quote, those symbols can be escaped with a backslash, e.g. `\\:` or the value may be enclosed in double quotes.\n\nRecords can be disabled by prepending the record type with `-`.\n\n\n### SOA Records\n\nSOA records are specified as follows:\n\n    {{soa:primary_server:admin:refresh:retry:expire:minimum:master_server:ttl}}\n\nThe `primary_server` and `admin` arguments are required, all others are optional.\nNote that the serial number for the zone is not specified, the tool automatically generates the serial number using the format YYYYMMDD## and ensures that the generated serial number is at least one greater than the currently deployed serial number of the zone.\n\n* `primary_server` is the name of the primary name server for the zone.\n* `admin` is the email address of the zone administrator.\nIt may be specified in bind format or standard email format, e.g.: `admin.example.com` or `admin@example.com`.\n* `refresh` is the time when the slave server(s) will refresh from the master.\nThe default value is `4h`.\n* `retry` is retry interval for slaves to refresh from the master in case of failure.\nThe default value is `1h`.\n* `expire` is the duration the slave will keep a zone file without a refresh from the master\nThe default value is `14d`.\n* `minimum` is the default time the slaves should cache the zone file.\nThe default value is `10m`.\n* `master_server` is a server to query for existing SOA serial numbers other than the `primary_server`.\nThe default value is the name of the primary server for the zone.\nThis is useful if the master server is not publicly accessible and therefore is not the same as the `primary_server`.\nIf the `primary_server` is not the master, be sure to set this value so that slave zone transfers happen properly after updates.\n* `ttl` is the TTL value for the SOA record.\nThe default value is empty.\n\nExample:\n\n    {{soa:ns1.example.com:admin@example.com}}\n\nBecomes:\n\n    @   SOA ns1.example.com. admin.example.com. 2016120900 4h 1h 14d 5m\n\n\n### SSHFP Records\n\nSSHFP records are specified as follows:\n\n    {{sshfp:hostname:key_file:ttl:type}}\n\nAll arguments are optional.\n\n* `hostname` is the host name for the SSHFP record.\nThe default value is `@`.\n* `key_file` is the name of the file the SSH host key files.\nKey file names may be absolute or relative paths.\nIf the file name is an absolute path, it will be used verbatim,\notherwise the file path will be relative to the configured `ssh` directory (`/etc/ssh` by default)\nand the file name will be passed into the `ssh` file name format string, adding the key type and extension.\nThe default value is `ssh_host`.\nIf using an absolute path, the `type` must also be specified.\n* `ttl` is the TTL value for the SSHFP record.\nThe default value is empty.\n* `type` is blank or one of the following: `rsa`, `dsa`, `ecdsa`, `ed25519`.\nIf `type` is blank, SSHFP records will be generated for all key types for which public key files can be found,\notherwise records for only the specified key type will be generated.\n\nTwo SSHFP records will be generated for each key file that is present, one with a SHA1 digest and one with a SHA256 digest.\n\nExample:\n\n    {{sshfp:}}\n\nBecomes:\n\n    @   SSHFP   1 1 8e97a98a87d8e88f17e9100ed1dc852d0b65dea7\n    @   SSHFP   1 2 cae4c8dc466978685915a030cdd518df707b4aa2cdaec6bb60b5b303b9d65207\n    @   SSHFP   3 1 04224f436dafa603aa7d335dd59cb03514bcb224\n    @   SSHFP   3 2 44cd6dd4363ab585280904ad41013de13eaba4d35842cd2d8c25778b1defc2d9\n\n\n### TLSA Records\n\nTLSA records are specified as follows:\n\n    {{tlsa:port:host:cert_file:usage:selector:proto:ttl:type:pass}\n\nThe `port` argument is required, all others are optional.\n\n* `port` is the TCP port for the service.\n* `host` is the host name for the service.\nThe default value is `@`.\n* `cert_file` is the file name of the certificate or private key used to secure the service.\nIf the file name is an absolute path, it will be used verbatim,\notherwise the file path will be relative to the configured `certificate`, `private_key`, `backup_key`, or `previous_key` directory\nand the file name will be passed into the corresponding file name format string.\nPrivate keys will be searched for in each of the key directories.\nThe default value is the name of the source zone file.\n* `usage` is one of the following: `pkix-ta`, `pkix-ee`, `dane-ta`, or `dane-ee`.\nThe default value is `pkix-ee`.\n* `selector` is `cert`, or `spki`.\nFor `cert` selectors the `cert_file` must be a certificate, for `spki` selectors the `cert_file` may be a certificate or a private key.\nThe default value is `spki`.\n* `proto` is one of the following: `tcp`, `udp`, `sctp`, or `dccp`.\nThe default value is `tcp`.\n* `ttl` is the TTL value for the TLSA record.\nThe default value is empty.\n* `type` is blank or one of the following: `rsa`, `ecdsa`.\nIf specified, it will restrict TLSA records to that key type,\notherwise TLSA records will be generated for all avaiable keys.\nKeys will be located by appending `.rsa` and `.ecdsa` after the name of the `cert_file` (before the file extension, e.g. `example.com.ecdsa.key`).\nThe `.rsa` suffix is optional for RSA keys.\n* `pass` is the password for encrypted private key files.\nThe default value is empty.\n\nTwo TLSA records will be generated for each available key type,\none using a SHA256 digest and one using a SHA512 digest.\nWhen using the `spki` selector, the tool will additionally look for backup and previous key files.\nIf a backup or previous key is found, additional TLSA records will be generated for those keys.\n\nExample:\n\n    {{tlsa:443:www}}\n\nBecomes:\n\n    _443._tcp.www   TLSA    1 1 1 90cebb19a148038c14e875153311bfc27603cbc64c78c9e9432114dd76425ab4\n    _443._tcp.www   TLSA    1 1 2 0f5ccb1dc77b699281c671976991acd6b597f42265329921d3273a9fcf71f599e1c6c7e15da4689a239eed9dbad0fbdfc0279ddefcf93a8f40680172ea60c4e0\n\n\n### TLSA Certificate Records\n\nTLSA Certificate records are specified as follows:\n\n    {{tlsa_cert:port:cert_file:usage:selector:proto:ttl:type}\n\nThe `port` argument is required, all others are optional.\n\n* `port` is the TCP port for the service.\n* `cert_file` is the file name of the certificate used to secure the service.\nIf the file name is an absolute path, it will be used verbatim,\notherwise the file path will be relative to the configured `certificate` directory\nand the file name will be passed into the corresponding file name format string.\nThe default value is the name of the source zone file.\n* `usage` is one of the following: `pkix-ta`, `pkix-ee`, `dane-ta`, or `dane-ee`.\nThe default value is `pkix-ee`.\n* `selector` is `cert`, or `spki`.\nThe default value is `spki`.\n* `proto` is one of the following: `tcp`, `udp`, `sctp`, or `dccp`.\nThe default value is `tcp`.\n* `ttl` is the TTL value for the TLSA record.\nThe default value is empty.\n* `type` is blank or one of the following: `rsa`, `ecdsa`.\nIf specified, it will restrict TLSA records to that key type,\notherwise TLSA records will be generated for all avaiable keys.\nKeys will be located by appending `.rsa` and `.ecdsa` after the name of the `cert_file` (before the file extension, e.g. `example.com.ecdsa.pem`).\nThe `.rsa` suffix is optional for RSA keys.\n\nThe host names used for the TLSA records will be taken from the subject alternative names in the certificate file.\nTwo TLSA records will be generated for each subject alternative name present in the certificate for each available key type,\none using a SHA256 digest and one using a SHA512 digest.\nCertificates must not contain subject alternative names containing wildcards.\n\nExample:\n\n    {{tlsa_cert:443}}\n\nBecomes:\n\n    _443._tcp.www   TLSA    1 1 1 90cebb19a148038c14e875153311bfc27603cbc64c78c9e9432114dd76425ab4\n    _443._tcp.www   TLSA    1 1 2 0f5ccb1dc77b699281c671976991acd6b597f42265329921d3273a9fcf71f599e1c6c7e15da4689a239eed9dbad0fbdfc0279ddefcf93a8f40680172ea60c4e0\n\n\n### SMIMEA Records\n\nSMIMEA records are specified as follows:\n\n    {{smimea:user:host:cert_file:usage:selector:ttl:type:pass}\n\nThe `user` argument is required, all others are optional.\n\n* `user` is the left hand side of the user's email address (before the `@`) or `*`.\n* `host` is the host name for the email address.\nThe default value is `@`.\n* `cert_file` is the file name of the certificate or private key used for S/MIME email for the user.\nIf the file name is an absolute path, it will be used verbatim,\notherwise the file path will be relative to the configured `certificate`, `private_key`, `backup_key`, or `previous_key` directory\nand the file name will be passed into the corresponding file name format string.\nPrivate keys will be searched for in each of the key directories.\nThe default value is the name of the source zone file.\nBy default the `user` argument + `@` will be prepended to the file name, e.g. {{smimea:user}} will search for `user@example.com.rsa.pem`, etc.\n* `usage` is one of the following: `pkix-ta`, `pkix-ee`, `dane-ta`, or `dane-ee`.\nThe default value is `pkix-ee`.\n* `selector` is `cert`, or `spki`.\nFor `cert` selectors the `cert_file` must be a certificate, for `spki` selectors the `cert_file` must be a private key.\nThe default value is `cert`.\n* `ttl` is the TTL value for the SMIMEA record.\nThe default value is empty.\n* `type` is blank or one of the following: `rsa`, `ecdsa`.\nIf specified, it will restrict TLSA records to that key type,\notherwise TLSA records will be generated for all avaiable keys.\nKeys will be located by appending `.rsa` and `.ecdsa` after the name of the `cert_file` (before the file extension, e.g. `example.com.ecdsa.key`).\nThe `.rsa` suffix is optional for RSA keys.\n* `pass` is the password for encrypted private key files.\nThe default value is empty.\n\nTwo SMIMEA records will be generated for each available key type,\none using a SHA256 digest and one using a SHA512 digest.\nFor `cert` selectors an additional record will be generated with the full contents of the certificate.\nWhen using the `spki` selector, the tool will additionally look for backup and previous key files.\nIf a backup or previous key is found, additional SMIMEA records will be generated for those keys.\n\nExample:\n\n    {{smimea:username}}\n\nBecomes:\n\n    16f78a7d6317f102bbd95fc9a4f3ff2e3249287690b8bdad6b7810f8._smimecert SMIMEA  1 0 1 90cebb19a148038c14e875153311bfc27603cbc64c78c9e9432114dd76425ab4\n    16f78a7d6317f102bbd95fc9a4f3ff2e3249287690b8bdad6b7810f8._smimecert SMIMEA  1 0 2 0f5ccb1dc77b699281c671976991acd6b597f42265329921d3273a9fcf71f599e1c6c7e15da4689a239eed9dbad0fbdfc0279ddefcf93a8f40680172ea60c4e0\n\n\n### ACME Challenge Records\n\nACME Challenge (TXT) records are specified as follows:\n\n    {{acme:challenge_file:ttl}}\n\nAll arguments are optional.\n\n* `challenge_file` is the file name of the json file storing ACME challenge information.\nIf the file name is an absolute path, it will be used verbatim,\notherwise the file path will be relative to the configured `acme` directory\nand the file name will be passed into the corresponding file name format string.\nThe default value is the name of the source zone file.\n* `ttl` is the TTL value for the TXT record.\nThe default value is empty.\n\nThe contents of the ACME challenge file is a single dictionary whose keys are host names and values are the ACME challenge values.\nOne record will be generated for each key/value pair.\nThis record type is meant to be used with an automatic ACME certificate managment bot doing dns-01 authorizations,\nsuch as [acmebot](https://github.com/plinss/acmebot).\nIf the challenge file does not exist, no records will be generated and no error will occour.\n\nExample:\n\n    {{acme:}}\n\nBecomes:\n\n    _acme-challenge.example.com     TXT     \"Tu6B_E8PvD1aE1S4CqHPfsgkU3YcdIjhpRDFlhLu0r4\"\n\n\n### DKIM Records\n\nDKIM (TXT) records are specified as follows:\n\n    {{dkim:selector:domain:host:ttl}}\n\nAll arguments are optional.\n\n* `selector` is the DKIM selector.\nThe default value is specified in the `settings` section of the config file.\n* `domain` is the name of the OpenDKIM private key.\nIf `domain` is an absolute path, it will be used verbatim,\notherwise the file path will be relative to the configured `dkim` directory\nand the file name will be passed into the corresponding file name format string.\nThe default value is the name of the source zone file.\n* `host` is the host name for the DKIM key.\nThe default value is `@`\n* `ttl` is the TTL value for the TXT record.\nThe default value is empty.\n\nExample:\n\n    {{dkim:}}\n\nBecomes:\n\n    default._domainkey  TXT \"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2G8vw5hMce1Zy2ovLnBTEbXxiOqY/CsLu+uqlyMOdOjOGtQqx1wX2aXksazjEIQ3x5RfbuvRfVn/84W4J6WI90/a606veHHalQouXLfQIlu3QuTUkjsj+aldchivc/AI/wZNiIPrPR96UGIzBbSE9zGvwpQ23Z1LzGUXAsPKx1wIDAQAB\"\n\n\n### DMARC Records\n\nDMARC (TXT) records are specified as follows:\n\n    {{dmarc:policy:rua:ruf:subdomain_policy:options:dkim_alignment:spf_alignment:report_format:interval:percent:host:ttl}}\n\nAll arguments are optional.\n\n* `policy` is one of the following: `none`, `quarantine`, or `reject`.\nThe default value is `none`.\n* `rua` is a comma separated lst of email addresses to receive aggregate reports.\n* `ruf` is a comma separated lst of email addresses to receive forensic reports.\n* `subdomain_policy` is one of the following: `none`, `quarantine`, or `reject`.\nThe default value is `none`.\n* `options` is one of the following: `all`, `any`, `dkim`, or `spf`.\nThe default value is `any`.\n* `dkim_alignment` is one of the following: `relaxed`, or `strict`.\nThe default value is `relaxed`.\n* `spf_alignment` is one of the following: `relaxed`, or `strict`.\nThe default value is `relaxed`.\n* `report_format` is one of the following: `afrf`, `iodef`.\nThe default value is `afrf`.\n* `interval` is a numeric value (seconds).\nThe default values is `86400` (1 day).\n* `percent` is a numeric value from 0 to 100.\nThe default value is `100`.\n* `host` is the host name for the DKIM key.\nThe default value is `@`\n* `ttl` is the TTL value for the TXT record.\nThe default value is empty.\n\nExample:\n\n    {{dmarc:rua@example.com:ruf@example.com}}\n\nBecomes:\n\n    _dmarc  TXT \"v=DMARC1; rua=mailto:rua@example.com; ruf=mailto:ruf@example.com; p=none; sp=none; fo=1; adkim=r; aspf=r; rf=afrf; ri=86400; pct=100;\"\n\n\n### CAA Records\n\nCAA records are specified as follows:\n\n    {{caa:tag:caname:flag:ttl}}\n\nThe `tag` and `caname` arguments are required, all others are optional.\n\n* `tag` is tag for the CAA record, usually `issue` or `issuewild`.\n* `caname` is the name of the CA.\n* `flag` is flag value for the CAA record.\nThe default value is `1`.\n* `ttl` is the TTL value for the CAA record.\nThe default value is empty.\n\nExample:\n\n    {{caa:issue:letsencrypt.org}}\n\nBecomes:\n\n    @   TYPE257 \\# 22 010569737375656c657473656e63727970742e6f7267\n\n\n### LDAP Records\n\nLDAP records are specified as follows:\n\n    {{ldap:}}\n\nAny DNS records found in the configured LDAP server matching the current zone will be included.\nThe following record types are supported: A, AAAA, TXT, SRV, and SSHFP.\n\n\n## Sample Source Zone File\n\nThe following sample of a simple source zone file:\n\n    {{soa:ns1.example.com:admin@example.com}}\n\n    {{ip4=192.0.2.0}}\n    {{pool6=2001:db8}}\n\n    @   NS  ns1.example.com.\n    @   NS  ns2.example.com.\n\n    ; Mail\n    @   MX  10  smtp.example.com.\n    @   TXT \"v=spf1 a:smtp.example.com -all\"\n\n    ; A records\n    @       A       {{ip4}}\n    @       AAAA    {{pool6}}::\n    smtp    A       {{ip4}}\n    smtp    AAAA    {{pool6}}::1\n    www     A       {{ip4}}\n    www     AAAA    {{pool6}}::1:0\n\n    ; DANE records - certificate in /etc/ssl/certs/example.com.pem\n    {{tlsa:25:smtp:usage=dane-ee}}\n    {{tlsa:443}}\n    {{tlsa:443:www}}\n\n    ; DKIM - certificate in /etc/opendkim/keys/example.com/default.private\n    {{dkim:}}\n    _adsp._domainkey    TXT \"dkim=all\"\n\n    ; CAA Records\n    {{caa:issue:letsencrypt.org}}\n\n    ; ACME\n    {{acme:}}\n\nWill result in the output of:\n\n    @   SOA ns1.example.com. admin.example.com. 2016120900 4h 1h 14d 5m\n\n    @   NS  ns1.example.com.\n    @   NS  ns2.example.com.\n\n    ; Mail\n    @   MX  10  smtp.example.com.\n    @   TXT \"v=spf1 a:smtp.example.com -all\"\n\n    ; A records\n    @       A       192.0.2.0\n    @       AAAA    2001:db8::\n    smtp    A       192.0.2.0\n    smtp    AAAA    2001:db8::1\n    www     A       192.0.2.0\n    www     AAAA    2001:db8::1:0\n\n    ; DANE records - certificate in /etc/ssl/certs/example.com.pem\n    _25._tcp.smtp   TLSA    3 1 1 90cebb19a148038c14e875153311bfc27603cbc64c78c9e9432114dd76425ab4\n    _25._tcp.smtp   TLSA    3 1 2 0f5ccb1dc77b699281c671976991acd6b597f42265329921d3273a9fcf71f599e1c6c7e15da4689a239eed9dbad0fbdfc0279ddefcf93a8f40680172ea60c4e0\n    _443._tcp       TLSA    1 1 1 90cebb19a148038c14e875153311bfc27603cbc64c78c9e9432114dd76425ab4\n    _443._tcp       TLSA    1 1 2 0f5ccb1dc77b699281c671976991acd6b597f42265329921d3273a9fcf71f599e1c6c7e15da4689a239eed9dbad0fbdfc0279ddefcf93a8f40680172ea60c4e0\n    _443._tcp.www   TLSA    1 1 1 90cebb19a148038c14e875153311bfc27603cbc64c78c9e9432114dd76425ab4\n    _443._tcp.www   TLSA    1 1 2 0f5ccb1dc77b699281c671976991acd6b597f42265329921d3273a9fcf71f599e1c6c7e15da4689a239eed9dbad0fbdfc0279ddefcf93a8f40680172ea60c4e0\n\n    ; DKIM - certificate in /etc/opendkim/keys/example.com/default.private\n    default._domainkey  TXT \"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2G8vw5hMce1Zy2ovLnBTEbXxiOqY/CsLu+uqlyMOdOjOGtQqx1wX2aXksazjEIQ3x5RfbuvRfVn/84W4J6WI90/a606veHHalQouXLfQIlu3QuTUkjsj+aldchivc/AI/wZNiIPrPR96UGIzBbSE9zGvwpQ23Z1LzGUXAsPKx1wIDAQAB\"\n    _adsp._domainkey    TXT \"dkim=all\"\n\n    ; CAA Records\n    @   TYPE257 \\# 22 010569737375656c657473656e63727970742e6f7267\n\n    ; ACME\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplinss%2Fbindtool","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fplinss%2Fbindtool","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplinss%2Fbindtool/lists"}