System and method for zone signing and key management in a DNS system

1. A computer-implemented method of signing a DNS zone file, the method comprising:

receiving, by a computer, an indication of a first DNS zone to be signed, the indication being received from a first remote user of a plurality of remote users, each remote user having control over a separate DNS zone;

retrieving, by the computer, unsigned zone data for the first DNS zone to be signed;

cryptographically signing, by the computer, the retrieved zone data; and

providing, by the computer, the signed zone data to a signed zone master for propagation to one or more DNS servers;

wherein the computer is configured to provide signed zone data to a signed zone master for each of the separate DNS zones in response to requests from each of the plurality of remote users.

2. The method of claim 1 , further comprising:

receiving, by the computer, a second indication of a second DNS zone to be signed, the second indication being received from a second remote user from the plurality of remote users;

retrieving, by the computer, unsigned second zone data for the second DNS zone to be signed;

cryptographically signing the retrieved second zone data; and

providing, by the computer, the signed second zone data to the signed zone master for propagation to one or more DNS servers.

3. The method of claim 1 , further comprising storing, by the computer, a key signing key for the first DNS zone.

4. The method of claim 1 , further comprising storing, by the computer, a zone signing key for the first DNS zone.

5. The method of claim 1 , further comprising tracking, by the computer, a schedule for a key signing key for the first DNS zone and a zone signing key for the second DNS zone.

6. The method of claim 1 , further comprising generating, by the computer, a key signing key for the first DNS zone and a zone signing key for the first DNS zone, wherein the computer cryoptographically signs the retrieved zone data with the key signing key and the zone signing key.

7. A system comprising one or more servers accessible to a plurality of remote users over a network, each server further comprising:

a processor;

a non-transitory computer-readable storage medium storing a plurality of instructions that cause the processor to;

receive an indication of a first DNS zone to be signed from a first user of the plurality of remote users, wherein each remote user has control over a separate DNS zone;

retrieve unsigned zone data for the first DNS zone to be signed;

cryptographically sign the retrieved zone data; and

provide the signed zone data to a signed zone master for propagation to one or more DNS servers;

wherein the one or more servers are configured to provide signed zone data to a signed zone master for each of the separate DNS zones in response to requests from each of the plurality of remote users.

8. The system of claim 7 , said instructions further causing the processor to:

receive a second indication of a second DNS zone to be signed from a second remote user of the plurality of remote users;

retrieve unsigned second zone data for the second DNS zone to be signed;

cryptographically sign the retrieved second zone data; and

provide the signed second zone data to the signed zone master for propagation to one or more DNS servers.

9. The system of claim 7 , said instructions further causing the processor to store a key signing key for the first DNS zone.

10. The system of claim 7 , said instructions further causing the processor to store a zone signing key for the first DNS zone.

11. The system of claim 7 , said instructions further causing the processor to track a schedule for a key signing key for the first DNS zone and a zone signing key for the second DNS zone.

12. The system of claim 7 , said instructions further causing the processor to generate a key signing key for the first DNS zone and a zone signing key for the first DNS zone, wherein

cryoptographically signing the retrieved zone data comprises signing the retrieved zone data with the key signing key and the zone signing key.

13. A non-transitory computer-readable storage medium storing a plurality of instructions that cause at least one processor to perform a method of signing a DNS zone file, said method comprising:

receiving an indication of a first DNS zone to be signed, the indication being received from a first remote user of a plurality of remote users, each remote user having control over a separate DNS zone;

retrieving unsigned zone data for the first DNS zone to be signed;

cryptographically signing the retrieved zone data; and

providing the signed zone data to a signed zone master for propagation to one or more DNS servers;

wherein the at least one processor is configured to provide signed zone data to a signed zone master for each of the separate DNS zones in response to requests from each of the plurality of remote users.

14. The computer-readable storage medium of claim 13 , said method further comprising:

receiving an indication of a second DNS zone to be signed from a second remote user from the plurality of remote users;

retrieving unsigned second zone data for the second DNS zone to be signed;

cryptographically signing the retrieved second zone data; and

providing the signed second zone data to the signed zone master for propagation to one or more DNS servers.

15. The computer-readable storage medium of claim 13 , said method further comprising storing a key signing key for the first DNS zone.

16. The computer-readable storage medium of claim 13 , said method further comprising storing a zone signing key for the first DNS zone.

17. The computer-readable storage medium of claim 13 , said method further comprising tracking a schedule for a key signing key for the first DNS zone and a zone signing key for the second DNS zone.

18. The computer-readable storage medium of claim 13 , said method further comprising generating a key signing key for the first DNS zone and a zone signing key for the first DNS zone, wherein

cryoptographically signing the retrieved zone data comprises signing the retrieved zone data with the key signing key and the zone signing key.

19. The computer-readable storage medium of claim 13 , said method further comprising storing a key signing key for the second DNS zone.

20. The computer-readable storage medium of claim 13 , said method further comprising storing a zone signing key for the second DNS zone.