bash 3 lines · 1 tab

DNSSEC zone signing basics for integrity of DNS answers

Kai Nakamura Apr 2026

1 tab

#!/usr/bin/env bash
dnssec-keygen -a ECDSAP256SHA256 -b 2048 -n ZONE example.com
dnssec-signzone -A -3 $(head -c 32 /dev/urandom | sha256sum | cut -d' ' -f1) -N increment -o example.com db.example.com

1 file · bash Explain with highlit

DNSSEC is not universal, but where it is available it closes an integrity gap that attackers still exploit. I keep the zone-signing workflow documented, monitor expiry on keys, and make sure operational ownership is clear. Security controls that nobody owns decay quickly.

Related snips

ruby

timestamp = request.headers.fetch('X-Signature-Timestamp')
signature = request.headers.fetch('X-Signature')
payload = request.raw_post

data = "#{timestamp}.#{payload}"
expected = OpenSSL::HMAC.hexdigest('SHA256', ENV.fetch('WEBHOOK_SECRET'), data)

HMAC signed API requests for webhook and partner integrity

hmac api-signing webhooks

by Kai Nakamura 2 tabs

plaintext

local   all             postgres                                peer
hostssl app_production  app_user        10.0.0.0/16             scram-sha-256
hostssl app_production  reporting_user  10.0.1.0/24             scram-sha-256
host    all             all             0.0.0.0/0               reject

PostgreSQL hardening with pg_hba and strict role separation

postgresql database-hardening roles

by Kai Nakamura 1 tab

bash

#!/usr/bin/env bash
nmap -Pn -sV -O --top-ports 1000 10.10.20.15
nmap -Pn -sC -sV api.internal.example.com
nmap -Pn -sU --top-ports 50 dns.internal.example.com

Nmap reconnaissance profiles for safe internal assessments

nmap reconnaissance pentesting

by Kai Nakamura 1 tab

plaintext

alert tcp $HOME_NET any -> $HOME_NET 445 (
  msg:"Possible SMB lateral movement enumeration";
  flow:to_server,established;
  content:"|FF|SMB"; depth:4;
  threshold:type both, track by_src, count 15, seconds 60;
  sid:1000001; rev:1;

Suricata IDS rule authoring for suspicious lateral movement

suricata ids detection

by Kai Nakamura 1 tab

plaintext

example.com.          IN TXT  "v=spf1 include:_spf.google.com -all"
default._domainkey    IN TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
_dmarc.example.com.   IN TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=s; aspf=s"

Email security baseline with SPF DKIM and DMARC records

email-security spf dkim

by Kai Nakamura 1 tab

php

<?php

use Illuminate\Support\Facades\DB;

public function createOrder(array $items, User $user)
{

Laravel database transactions for data integrity

laravel database transactions

by Carlos Mendez 3 tabs

Share this code

Here's the card — post it anywhere.

DNSSEC zone signing basics for integrity of DNS answers — share card

Link copied