one verdict for a DNS zone, six checks in parallel
probe-dns answers one question about a DNS zone: is anything wrong
with it right now, and is anything about to go wrong. Six checks --
the delegation at the parent against the NS set of the zone, with
its glue; the SOA serial on every authoritative server and its age;
DNSSEC, the DS at the parent against the DNSKEY of the zone, the
RRSIG on the apex and how far their expiration is; the CAA at the
apex against the issuers allowed; every secondary answering the apex
with the AA flag and the same serial; and no authoritative server
answering a question outside the zone -- run in parallel, each under
its own deadline, so the probe costs the slowest check and not their
sum. A signature that expires takes the whole zone down at once, and
its date is readable weeks ahead: that check is why the probe exists.

The default output follows the reed-alert probe contract: silence and
rc 0 when everything holds, rc 1 and a single summary line on stderr
naming the failing checks, rc 2 when the probe itself could not do its
work. With -f json the same run is printed as one JSON object, the
summary line staying on stderr. With -f text every check is listed
with its verdict and its detail, for someone reading at a terminal.
The configuration comes from the file -c names, else from
/etc/probe-dns/<domain>.conf, else from /etc/probe-dns.conf. A check
that could not test at all is run again, up to retries attempts inside
its own deadline: a query lost on the wire says nothing about the zone,
and a check that concluded fail is never retried. A verdict where every
check concluded is kept under /var/cache/probe-dns/<zone> and served
again while it is younger than cache_ttl_min minutes, which -n bypasses;
both are off until the configuration asks for them. Unprivileged
throughout. dig(1) from the base system and hn-timeout, timeout(1)
with a race closed (sysutils/hn-timeout), are the only tools it needs.

Maintainer: Jean-Gerard Pailloncy <j-g@pailloncy.com>
