01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:
az account list
--query '[*].id'
02 The command output should return the requested subscription identifiers (IDs):
[
"abcdabcd-1234-abcd-1234-abcdabcdabcd",
"abcd1234-abcd-1234-abcd-abcd1234abcd"
]
03 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):
az account set
--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd
04 Run network dns dnssec-config create command (Windows/macOS/Linux) to enable the DNSSEC security feature for the selected Azure DNS zone:
az network dns dnssec-config create
--resource-group "cloud-shell-storage-westeurope"
--zone-name "trendmicro.com"
05 The command output should return the DNSSEC configuration information available for the selected DNS zone:
{
"id": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Network/dnszones/trendmicro.com/dnssecConfigs/default",
"name": "default",
"provisioningState": "Succeeded",
"resourceGroup": "cloud-shell-storage-westeurope",
"signingKeys": [
{
"delegationSignerInfo": [],
"flags": 256,
"keyTag": 8337,
"protocol": 3,
"publicKey": "abcd1234abcd1234",
"securityAlgorithmType": 13
},
{
"delegationSignerInfo": [
{
"digestAlgorithmType": 2,
"digestValue": "ABCD1234ABCDABCD1234ABCDABCD1234ABCDABCD1234ABCDABCD1234ABCDABCD",
"record": "12345 13 2 ABCD1234ABCDABCD1234ABCDABCD1234ABCDABCD1234ABCDABCD1234ABCDABCD"
}
],
"flags": 257,
"keyTag": 12345,
"protocol": 3,
"publicKey": "abcd1234abcd1234",
"securityAlgorithmType": 13
}
],
"type": "Microsoft.Network/dnszones/dnssecConfigs"
}
06 To establish a DNSSEC chain of trust, you must add a DS record to the parent DNS zone or registrar using the DNSSEC information listed under DNSSEC delegation information. If you own the parent DNS zone, you can add a DS record directly to the parent yourself. As an example, we use the DNS zone hosted with Azure, selected in the previous steps. To create the required DS record, run network dns record-set ds add-record command (Windows/macOS/Linux). For the --key-tag parameter use the "keyTag" attribute value returned in the previous step. For --algorithm use the "securityAlgorithmType" attribute value. For --digest, use the "digestValue" attribute value, and for --digest-type use the "digestAlgorithmType" value:
az network dns record-set ds add-record
--resource-group "cloud-shell-storage-westeurope"
--zone-name "trendmicro.com"
--record-set-name "secure"
--key-tag 12345
--algorithm 13
--digest "ABCD1234ABCDABCD1234ABCDABCD1234ABCDABCD1234ABCDABCD1234ABCDABCD"
--digest-type 2
07 The command output should return the information available for the new DNS record:
{
"DSRecords": [
{
"algorithm": 13,
"digest": {
"algorithmType": 2,
"value": "ABCD1234ABCDABCD1234ABCDABCD1234ABCDABCD1234ABCDABCD1234ABCDABCD"
},
"keyTag": 12345
}
],
"TTL": 3600,
"fqdn": "secure.trendmicro.com.",
"id": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Network/dnszones/trendmicro.com/DS/secure",
"name": "secure",
"provisioningState": "Succeeded",
"resourceGroup": "cloud-shell-storage-westeurope",
"targetResource": {},
"trafficManagementProfile": {},
"type": "Microsoft.Network/dnszones/DS"
}
08 Repeat steps no. 4 - 7 for each Azure DNS zone that you want to configure, deployed in the selected Azure subscription.
09 Repeat steps no. 3 – 8 for each Azure subscription created in your Microsoft Azure cloud account.
Security