id: dnssec-detection

info:
  name: DNSSEC Detection
  description: A template to check if Delegation of Signing (DS) record provides information about a signed zone file when DNSSEC enabled.
  author: pdteam
  severity: info
  tags: dns,dnssec
  reference: https://www.cyberciti.biz/faq/unix-linux-test-and-validate-dnssec-using-dig-command-line/

dns:
  - name: "{{FQDN}}"
    type: DS
    class: inet
    recursion: true
    retries: 3

    extractors:
      - type: regex
        group: 1
        regex:
          - "IN\tDS\t(.+)"