ans-dns

Overview ¶

Command ans-dns is a small authoritative DNS server + zone-management CLI for local-dev testing of the full ANS lifecycle end-to-end.

Subcommands:

ans-dns serve   [--addr HOST:PORT] [--zone PATH]  [--dnssec]
ans-dns install <ra-url> <agent-id> [--api-key KEY] [--zone PATH]
ans-dns clear   <agent-id>                          [--zone PATH]

`serve` runs a miekg/dns authoritative server backed by a JSON zone file on disk (reloaded on each request so `install`/`clear` subcommands take effect without a restart). With `--dnssec`, the server answers TLSA queries with the AD bit set so the RA's verifier surfaces DNSSECVerified=true on the resulting attestation. There is no chain-of-trust to any root; the DO bit is honored for completeness but signatures aren't validated against a parent zone.

`install` fetches the RA's expected-records list for an agent and writes those records into the zone file. `clear` removes them.

Not a production nameserver. No zone transfers, no NOTIFY, no secondary-server protocol. It exists so an operator can point their RA at `127.0.0.1:15353` and drive verify-dns from a local terminal.