Mentioned in SAL (#wikimedia-cloud) [2021-03-25T10:06:00Z] <arturo> created & delegated DNS zone lists.wmcloud.org (T278358)

In T278358#6950436, @Legoktm wrote:

lists.wmcloud.org shows up for me now, but it's not letting me create the TXT record: "Error: Unable to create the record set.". Maybe I'm doing something wrong?

You need to use the FQDN, so wikimedia._domainkey.lists.wmcloud.org. here I guess. Designate very confusingly does not inherit any information from the zone in the individual record.

It's more than the FQDN issue. I was able to make a bd808.lists.wmcloud.org TXT record with "testing" as the payload, but then when I tried to change the payload to "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9+YM0P4vZEhLwZkUbhRokEj5v5SiyX0g03Anlwz7Xyvejdgbq9I6JYsrDPWRurc1UvDDigE6q1OtkKHJI8eB3L0Wpv+oqH2sxkq1edC2YRaQuUQKG+4yIr3kUidRGD95T9UsGBl7IH7OyQ5YWVjUMnoAWaabkXTvDwR0OQjEo2QS72ErTbwnRwMGysOpo9PHrYBq/Cz1Pc6LdF/S5hu54rvNehO878tQ1CFMLOHnHid1v0MkaAx8k8jH6mR2PV3nGXsy5Wbc5SfdQUwa25Zgq7eZ1ZFUXaLjk4X2COdy4xHFkaUzDhjoiAxQ0mlgkm28cEDdB3keC4VQ3wl8DgGBOQIDAQAB" I got the same content free error message. This kind of feels like a db schema limit or something similar.

In T278358#6950493, @bd808 wrote:

This kind of feels like a db schema limit or something similar.

I can put in 255 chars, but not 256. :)

In T278358#6950500, @bd808 wrote:

In T278358#6950493, @bd808 wrote:

This kind of feels like a db schema limit or something similar.

I can put in 255 chars, but not 256. :)

https://bugs.launchpad.net/designate/+bug/1595265

I can try using an ed25519 key to see how much shorter that'll be. In any case the lack of DKIM in cloud isn't a huge issue if it's complicated to fix.

With a private ed25519 key I just created, the new DNS value should be: v=DKIM1; k=ed25519; p=83sgMULyUlfdIiGu2WUK0qdclRS314E8nrcVBNOWEuw= (66 characters) ... but horizon still doesn't want to let me create it.

In T278358#6950507, @bd808 wrote:

https://bugs.launchpad.net/designate/+bug/1595265

T203035

In T278358#6950885, @Legoktm wrote:

With a private ed25519 key I just created, the new DNS value should be: v=DKIM1; k=ed25519; p=83sgMULyUlfdIiGu2WUK0qdclRS314E8nrcVBNOWEuw= (66 characters) ... but horizon still doesn't want to let me create it.

The API also apparently does not like whitespace in the TXT value. I was able to create the record with v=DKIM1;k=ed25519;p=83sgMULyUlfdIiGu2WUK0qdclRS314E8nrcVBNOWEuw= as the payload.

This still has problems though:

$ dig TXT wikimedia._domainkey.lists.wmcloud.org.

; <<>> DiG 9.10.6 <<>> TXT wikimedia._domainkey.lists.wmcloud.org.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49008
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;wikimedia._domainkey.lists.wmcloud.org.	IN TXT

;; ANSWER SECTION:
wikimedia._domainkey.lists.wmcloud.org.	3533 IN	TXT "v=DKIM1"

;; Query time: 41 msec
;; SERVER: 192.168.11.1#53(192.168.11.1)
;; WHEN: Sat Mar 27 11:28:21 MDT 2021
;; MSG SIZE  rcvd: 87

The payload is truncated at the first ; character.

I have tried yet another way, by creating 3 separate values for the TXT record:

$ dig TXT wikimedia._domainkey.lists.wmcloud.org.

; <<>> DiG 9.10.6 <<>> TXT wikimedia._domainkey.lists.wmcloud.org.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39038
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;wikimedia._domainkey.lists.wmcloud.org.	IN TXT

;; ANSWER SECTION:
wikimedia._domainkey.lists.wmcloud.org.	3599 IN	TXT "p=83sgMULyUlfdIiGu2WUK0qdclRS314E8nrcVBNOWEuw="
wikimedia._domainkey.lists.wmcloud.org.	3599 IN	TXT "v=DKIM1"
wikimedia._domainkey.lists.wmcloud.org.	3599 IN	TXT "k=ed25519"

;; Query time: 126 msec
;; SERVER: 192.168.11.1#53(192.168.11.1)
;; WHEN: Sat Mar 27 11:28:23 MDT 2021
;; MSG SIZE  rcvd: 168

If the TXT body is input wrapped in " chars the ; splitting seems to be avoided, but the " also ends up in the output:

$ dig TXT wikimedia._domainkey.lists.wmcloud.org.

; <<>> DiG 9.10.6 <<>> TXT wikimedia._domainkey.lists.wmcloud.org.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12395
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;wikimedia._domainkey.lists.wmcloud.org.	IN TXT

;; ANSWER SECTION:
wikimedia._domainkey.lists.wmcloud.org.	3599 IN	TXT "v=DKIM1;k=ed25519;p=83sgMULyUlfdIiGu2WUK0qdclRS314E8nrcVBNOWEuw="

;; Query time: 121 msec
;; SERVER: 192.168.11.1#53(192.168.11.1)
;; WHEN: Sat Mar 27 11:33:43 MDT 2021
;; MSG SIZE  rcvd: 144

This final state may be usable. Does anyone have a DKIM selector to test it with using https://www.dmarcanalyzer.com/dkim/dkim-checker/ or another validation service?

In T278358#6951450, @bd808 wrote:

This final state may be usable. Does anyone have a DKIM selector to test it with using https://www.dmarcanalyzer.com/dkim/dkim-checker/ or another validation service?

Oh, duh, the selector is wikimedia. This test thinks things are setup correctly:

This seems to be a valid DKIM Record.
DNS Record - wikimedia._domainkey.lists.wmcloud.org
Selector - wikimedia
Domain - lists.wmcloud.org
v=DKIM1;k=ed25519;p=83sgMULyUlfdIiGu2WUK0qdclRS314E8nrcVBNOWEuw=
Declared tags

Tag	Value	Description
v	DKIM1	DKIM protocol version.
p	83sgMULyUlfdIiGu2WUK0qdcl...	Your base64 encoded public key.
k	ed25519	The 'k=' tag provide a list of mechanisms that can be used to decode a DKIM signature. ('rsa' is used most often)