xDNSGuard: DNS Root Zone Integrity

The Problem

DNSSEC root zone signing keys (KSK/ZSK) are single points of failure for the entire internet. Key ceremonies are infrequent and rely on physical security alone.

The current DNSSEC key ceremony model concentrates root zone signing authority in two physical facilities. While the ceremonies themselves are well-secured, the underlying key material remains a monolithic secret. If either facility is compromised, the trust anchor for the global DNS hierarchy is undermined.

Country-code TLDs face similar challenges: ccTLD operators must protect zone signing keys with limited budgets and infrastructure. Many rely on single-HSM deployments with manual backup procedures that introduce human error and insider threat risk.

The Old Way

The PRIVATE.ME Solution

XorIDA splits root zone signing keys across geographically distributed registrars. No single registrar, facility, or jurisdiction holds complete key material.

The threshold sharing model transforms the DNSSEC key ceremony from a physical-security-dependent process into a cryptographic-guarantee-backed protocol. Key ceremonies become distributed events where K-of-N registrars cooperate to sign, but no single participant can act alone.

Each share is HMAC-SHA256 tagged, ensuring tamper detection at every stage. The split operation uses GF(2) arithmetic for sub-millisecond performance, making it feasible to integrate into existing ceremony workflows without introducing latency.

The New Way

How It Works

The root zone integrity pipeline integrates with existing DNSSEC key ceremony processes while replacing the single-point-of-trust model with threshold cryptographic guarantees.

Fast Onboarding: 3 Acceleration Levels

Traditional DNS security requires manual resolver configuration, DNSSEC key generation, and custodian coordination. xDNSGuard collapses this to 15 seconds with zero-click accept, 90 seconds with one-line CLI, and 10 minutes with deploy buttons.

// .env file
XDNS_INVITE_CODE=XDNS-abc123

// Auto-accept on first query
import { createDNSGuardManager } from '@private.me/xdnsguard';

const manager = createDNSGuardManager({
  zone: 'example.com',
  resolvers: ['8.8.8.8', '1.1.1.1', '9.9.9.9'],
  queryThreshold: 2,
  queryShares: 3
});
// ✅ Invite auto-accepted, ready to query

# Install and initialize
npx @private.me/xdnsguard init

# Output:
# ✅ DNS Guard DID generated
# ✅ Saved to .env
# ✅ Resolvers configured
# Ready to protect zones

# Configure your first zone
npx @private.me/xdnsguard setup \
  --zone example.com \
  --resolvers 8.8.8.8,1.1.1.1 \
  --threshold 2 --shares 3

Example: Zero-Click Accept

Set invite code in environment, configure zone on first query. No manual setup required.

// 1. Set environment variable
// .env file:
XDNS_INVITE_CODE=https://xdns.private.me/invite/XDNS-abc123

// 2. Configure zone (auto-accepts invite)
import { createDNSGuardManager } from '@private.me/xdnsguard';

const manager = await createDNSGuardManager({
  zone: 'example.com',
  enableSplitChannel: true,
  queryThreshold: 2,
  queryShares: 3,
  resolvers: ['8.8.8.8', '1.1.1.1', '9.9.9.9'],
  enableDNSSEC: true,
  enableQueryLog: true,
  onProgress: (percent, msg) => console.log(`[${percent}%]`, msg)
});

// 3. Execute split-channel query
const queryResult = await manager.query({
  id: 'q1',
  domain: 'www.example.com',
  type: 'A',
  timestamp: new Date(),
  client: 'did:key:z6Mk...',
  dnssecValidation: true
});

if (queryResult.ok) {
  console.log('✅ Query protected via 2-of-3 split');
  console.log('✅ DNSSEC validated');
  console.log('✅ Query encrypted in logs');
  console.log('Response:', queryResult.value.records);
}

// What happened:
// 1. Invite auto-accepted from XDNS_INVITE_CODE env var
// 2. DNS Guard DID generated and saved to .env
// 3. Query split via XorIDA (2-of-3)
// 4. Shares sent to 3 independent resolvers
// 5. Responses verified with HMAC-SHA256
// 6. Query logged with AES-256-GCM encryption
// Total time: ~15 seconds

Example: CLI Setup

One command generates DNS Guard DID, configures resolvers, and protects your first zone.

# Step 1: Install CLI globally
npm install -g @private.me/xdnsguard

# Step 2: Initialize (generates DID, configures resolvers)
xdnsguard init

# Output:
# Generating DNS Guard DID...
# ✅ DNS Guard DID: did:key:z6Mk...
# ✅ Saved to .env
# ✅ Resolvers configured: 8.8.8.8, 1.1.1.1, 9.9.9.9
# Ready to protect zones

# Step 3: Configure your first zone
xdnsguard setup \
  --zone example.com \
  --resolvers 8.8.8.8,1.1.1.1,9.9.9.9 \
  --threshold 2 \
  --shares 3 \
  --dnssec-algorithm ED25519

# Output:
# [0%] Validating configuration...
# [20%] Generating DNSSEC key pair...
# [40%] Splitting private key via XorIDA...
# [70%] Distributing shares to custodians...
# [100%] Zone configuration complete
#
# ✅ Zone configured with 2-of-3 split-channel
# ✅ DNSSEC key generated (ED25519)
# ✅ Key shares distributed to 3 custodians
# ✅ Query logging encrypted
# Ready to serve queries: xdnsguard serve

# Total time: ~90 seconds

Example: Deploy Button

Click one button to provision split-channel resolver infrastructure with DNSSEC key custody, encrypted logging, and DDoS mitigation.

Use Cases

Integration

import { splitRootKey, performCeremony } from '@private.me/xdnsguard';

// Split root KSK across 5 registrars (3 needed)
const shares = await splitRootKey(rootKsk, registrars, {
  n: 5,
  k: 3,
});

// Distribute to geographically separated sites
await Promise.all(shares.map((s, i) =>
  deliverToRegistrar(registrars[i], s)
));

// Perform threshold signing ceremony
const result = await performCeremony({
  shares: [shares[0], shares[2], shares[4]],
  zone: '.',
});

Security Properties

Verifiable Data Protection

Every operation in this ACI produces a verifiable audit trail via xProve. HMAC-chained integrity proofs let auditors confirm that data was split, stored, and reconstructed correctly — without accessing the data itself.

Ready to deploy xDNSGuard?

Talk to Ren, our AI sales engineer, or book a live demo with our team.

Ship Proofs, Not Source

xDnsguard generates cryptographic proofs of correct execution without exposing proprietary algorithms. Verify integrity using zero-knowledge proofs — no source code required.

Use Cases