pymensago/dnssec.py
def check_resolver_support() -> str:
	'''Checks for the source to use to check DNSSEC signatures and returns a string indicating the
	source.
	
	Parameters:
	  * None
	
	Returns:
	  * 'default': the DNS servers in the network config support DNSSEC
	  * 'upstream': the authoritative server for the domain needs to be queried directly for DNSSEC
	'''
	global drdnssec_support, drdnssec_ips

	if drdnssec_support:
		return drdnssec_support

	drdnssec_support = 'upstream'
	
	# On most platforms, the OS has its own stub resolver and DNS cache. We'll try that first.
	# We know that the root domain is signed, so we'll try to get the DNSKEY for the root zone.
	# If our resolver doesn't return a record, then we know it doesn't support DNSSEC
	res = dns.resolver.get_default_resolver()
	for nsip in res.nameservers:
		request = dns.message.make_query('.', dns.rdatatype.DNSKEY, want_dnssec=True)
		response = dns.query.udp(request, nsip)
		if response.rcode() == 0 and len(response.answer) > 0:
			drdnssec_ips.append(nsip)
			drdnssec_support = 'default'

	return drdnssec_support
Checks for the source to use to check DNSSEC signatures and returns a string indicating the
	source.
	
	Parameters:
	  * None
	
	Returns:
	  * 'default': the DNS servers in the network config support DNSSEC
	  * 'upstream': the authoritative server for the domain needs to be queried directly for DNSSEC
	
Checks for the source to use to check DNSSEC signatures and returns a string indicating the
source.

None

'default': the DNS servers in the network config support DNSSEC
'upstream': the authoritative server for the domain needs to be queried directly for DNSSEC
Checks for the source to use to check DNSSEC signatures and returns a string indicating the source . None ' default ' : the DNS servers in the network config support DNSSEC ' upstream ' : the authoritative server for the domain needs to be queried directly for DNSSEC
def check_resolver_support() -> str:
	global drdnssec_support, drdnssec_ips
	if drdnssec_support:
		return drdnssec_support
	drdnssec_support = 'upstream'
	res = dns.resolver.get_default_resolver()
	for nsip in res.nameservers:
		request = dns.message.make_query('.', dns.rdatatype.DNSKEY, want_dnssec=True)
		response = dns.query.udp(request, nsip)
		if response.rcode() == 0 and len(response.answer) > 0:
			drdnssec_ips.append(nsip)
			drdnssec_support = 'default'
	return drdnssec_support
def check_resolver_support ( ) -> str : global drdnssec_support , drdnssec_ips if drdnssec_support : return drdnssec_support drdnssec_support = 'upstream' res = dns . resolver . get_default_resolver ( ) for nsip in res . nameservers : request = dns . message . make_query ( '.' , dns . rdatatype . DNSKEY , want_dnssec = True ) response = dns . query . udp ( request , nsip ) if response . rcode ( ) == 0 and len ( response . answer ) > 0 : drdnssec_ips . append ( nsip ) drdnssec_support = 'default' return drdnssec_support
Checks for the source to use to check DNSSEC signatures and returns a string indicating the
source.
Checks for the source to use to check DNSSEC signatures and returns a string indicating the source .
'''Checks for the source to use to check DNSSEC signatures and returns a string indicating the
	source.
	
	Parameters:
	  * None
	
	Returns:
	  * 'default': the DNS servers in the network config support DNSSEC
	  * 'upstream': the authoritative server for the domain needs to be queried directly for DNSSEC
	''' # On most platforms, the OS has its own stub resolver and DNS cache. We'll try that first. # We know that the root domain is signed, so we'll try to get the DNSKEY for the root zone. # If our resolver doesn't return a record, then we know it doesn't support DNSSEC