# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1395491447 -3600
# Node ID 80ce8d7f7f56748a9561fa9a114f3e47cefd5569
# Parent  6e91b7ab36c18dd32a7ee385a5519b3d03cf21b6
mod_s2s_auth_dane.wiki: more text, examples and links

diff -r 6e91b7ab36c1 -r 80ce8d7f7f56 mod_s2s_auth_dane.wiki
--- a/mod_s2s_auth_dane.wiki	Tue Mar 18 15:10:53 2014 +0100
+++ b/mod_s2s_auth_dane.wiki	Sat Mar 22 13:30:47 2014 +0100
@@ -3,19 +3,19 @@
 
 = Introduction =
 
-This module implements DANE as described in 
+This module implements DANE as described in
 [http://tools.ietf.org/html/draft-miller-xmpp-dnssec-prooftype Using DNS Security Extensions (DNSSEC) and DNS-based Authentication of Named Entities (DANE) as a Prooftype for XMPP Domain Name Associations].
 
 = Dependecies =
 
-This module requires a DNSSEC aware DNS resolver.  Prosodys internal DNS 
-module does not support DNSSEC.  Therefore, to use this module, a 
+This module requires a DNSSEC aware DNS resolver.  Prosodys internal DNS
+module does not support DNSSEC.  Therefore, to use this module, a
 replacement is needed, such as
-[http://code.zash.se/luaunbound this libunbound and LuaJIT FFI based one].
+[https://www.zash.se/luaunbound.html this libunbound and LuaJIT FFI based one].
 
 = Configuration =
 
-This module has no options.  Just add it to `modules_enabled`;
+After [https://prosody.im/doc/installing_modules installing the module], just add it to `modules_enabled`;
 
 {{{
 modules_enabled = {
@@ -26,11 +26,25 @@
 
 = DNS Setup =
 
+In order for other services to verify your site using using this plugin,
+you need to publish TLSA records (and they need to have this plugin).
+Here's an example using "DANE-EE Cert SHA2-256" for a host named
+xmpp.example.com serving the domain example.com.
+
 {{{
+$ORIGIN example.com
 _xmpp-server._tcp IN SRV 0 0 5269 xmpp
+xmpp IN A 192.0.2.68
+xmpp IN AAAA 2001:0db8:0000:0000:4441:4e45:544c:5341
 _5269._tcp.xmpp IN TLSA 3 0 1 E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
 }}}
 
+[http://www.internetsociety.org/deploy360/dnssec/tools/ List of DNSSEC and DANE tools]
+
+= Further reading =
+
+* [http://tools.ietf.org/html/draft-ietf-dane-ops TLSA implementation and operational guidance]
+
 = Compatibility =
 
 Requires 0.9 or above.