Learning DNS - Dynamic Updates & Automation

#Introduction

In a fast-changing world, manually editing zones is a curse: slow, prone to typos, and unable to keep up with containers or VMs that change IPs every minute. Dynamic update (RFC 2136) solves this by letting clients add, modify, and delete records over the protocol.

Episode 12 covers enabling dynamic updates in PowerDNS, practicing nsupdate, and integrating with DHCP, Docker, and provisioning scripts. After this episode, DNS changes can be done by machines, not humans.

#Enabling Dynamic Update

#pdnsutil enable-dnsupdate

Dynamic updates are disabled by default. Enable them per zone:

pdnsutil enable-dnsupdate example.com
pdnsutil show-zone example.com | grep -i dnsupdate

pdnsutil enable-dnsupdate example.com marks the example.com zone as accepting dynamic updates. To enable globally, set dnsupdate=yes in pdns.conf — but enabling per zone is safer because the control is finer-grained.

#Source-Based Restrictions

Because dynamic updates change data directly, you must restrict who can do it. The most precise way is TSIG: create a key per client or per group, then grant update rights only on the relevant zone.

pdnsutil generate-tsig-key dhcp-key hmac-sha256
pdnsutil add-tsig-key dhcp-key hmac-sha256 <key-hash>

With TSIG, update requests without a valid signature are rejected. That's far better than opening dynamic updates with no authentication.

#nsupdate: The Dynamic Update Client

#Your First Update

nsupdate is the standard client for RFC 2136. Create an instruction file and run it:

cat > /tmp/update.txt << 'EOF'
server 127.0.0.1
zone example.com
update add laptop.example.com 300 A 192.0.2.100
send
EOF
 
nsupdate -v /tmp/update.txt

The instructions above add laptop.example.com with a 300-second TTL and address 192.0.2.100. With TSIG, add the -k flag:

nsupdate -k /etc/bind/Kdhcp-key.+165+00000.key -v /tmp/update.txt

#Deleting and Replacing

Dynamic updates also delete records, useful when a VM dies:

cat > /tmp/delete.txt << 'EOF'
server 127.0.0.1
zone example.com
update delete laptop.example.com A
send
EOF
 
nsupdate -v /tmp/delete.txt

The combination of add, delete, and replace through scripts turns DNS into a living database that follows your infrastructure's state.

#Integration from Various Sources

#DHCP and Docker

The most common case is DHCP registering hosts: every time a client gets an IP, the DHCP server runs a script that calls nsupdate. The same pattern is used for containers: when a container comes up and gets an IP, a provisioning script registers its name in DNS.

HOST=app-01
IP=192.0.2.101
{
  echo "server 127.0.0.1"
  echo "zone example.com"
  echo "update delete $HOST.example.com A"
  echo "update add $HOST.example.com 300 A $IP"
  echo "send"
} | nsupdate -k /etc/bind/Kapp.key -v

The script above is idempotent: it deletes the old record first, then adds the new one, so it's safe to run repeatedly without duplicate errors.

#Combining with the API

For large-scale automation, combine dynamic updates with the PowerDNS API (episode 20): the API for structured zone and record operations, nsupdate for fast updates from clients like DHCP. The two complement each other — the API handles administrative changes, nsupdate handles high-speed operational changes.

dig @127.0.0.1 laptop.example.com A +short

#Dynamic Update Security

#Principles to Uphold

Dynamic updates are a door that can be misused. Rules you must enforce:

• Enable per zone, not globally, unless there's a strong reason.
• TSIG is mandatory: without a signature, updates are rejected.
• Short TTLs (300 seconds or less) for frequently-changing records.
• Restrict client sources via firewall and allow-update-from in pdns.conf.

allow-update-from=192.0.2.0/24

allow-update-from restricts the addresses that may send dynamic updates. Combined with TSIG, you get two layers of defense at once.

#Conclusion

Episode 12 makes your DNS dynamic: enabling per-zone updates, making automatic changes via nsupdate, integrating with DHCP and Docker, and securing it all with TSIG and source restrictions.

Key takeaways:

• pdnsutil enable-dnsupdate enables dynamic updates per zone.
• nsupdate adds, modifies, and deletes records over RFC 2136.
• Idempotent provisioning scripts delete first, then add records.
• Dynamic updates must be secured with TSIG and allow-update-from.
• Combine dynamic updates with the API for comprehensive automation.

In episode 13, we'll cover DNSSEC: signing zones on the Authoritative side — the KSK and ZSK concepts, RSA and ECDSA P-256 algorithms, the RRSIG, DNSKEY, DS, NSEC, and NSEC3 records, plus hands-on practice with pdnsutil secure-zone, key rotation, and publishing DS to your registrar.