diff --git a/pkg/dnsconfigs/tsig_config.go b/pkg/dnsconfigs/tsig_config.go
new file mode 100644
index 0000000..3dc0e6d
--- /dev/null
+++ b/pkg/dnsconfigs/tsig_config.go
@@ -0,0 +1,8 @@
+// Copyright 2021 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+
+package dnsconfigs
+
+// TSIGConfig 配置
+type TSIGConfig struct {
+	IsOn bool `yaml:"isOn" json:"isOn"`
+}
diff --git a/pkg/rpc/pb/model_ns_access_log.pb.go b/pkg/rpc/pb/model_ns_access_log.pb.go
index 13e1164..93cf668 100644
--- a/pkg/rpc/pb/model_ns_access_log.pb.go
+++ b/pkg/rpc/pb/model_ns_access_log.pb.go
@@ -46,6 +46,7 @@ type NSAccessLog struct {
 	Timestamp    int64   `protobuf:"varint,13,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
 	RequestId    string  `protobuf:"bytes,14,opt,name=requestId,proto3" json:"requestId,omitempty"`
 	TimeLocal    string  `protobuf:"bytes,15,opt,name=timeLocal,proto3" json:"timeLocal,omitempty"`
+	Error        string  `protobuf:"bytes,16,opt,name=error,proto3" json:"error,omitempty"`
 }
 
 func (x *NSAccessLog) Reset() {
@@ -185,12 +186,19 @@ func (x *NSAccessLog) GetTimeLocal() string {
 	return ""
 }
 
+func (x *NSAccessLog) GetError() string {
+	if x != nil {
+		return x.Error
+	}
+	return ""
+}
+
 var File_models_model_ns_access_log_proto protoreflect.FileDescriptor
 
 var file_models_model_ns_access_log_proto_rawDesc = []byte{
 	0x0a, 0x20, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x73, 0x2f, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x5f, 0x6e,
 	0x73, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x6c, 0x6f, 0x67, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x12, 0x02, 0x70, 0x62, 0x22, 0xed, 0x03, 0x0a, 0x0b, 0x4e, 0x53, 0x41, 0x63, 0x63,
+	0x74, 0x6f, 0x12, 0x02, 0x70, 0x62, 0x22, 0x83, 0x04, 0x0a, 0x0b, 0x4e, 0x53, 0x41, 0x63, 0x63,
 	0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x12, 0x1a, 0x0a, 0x08, 0x6e, 0x73, 0x4e, 0x6f, 0x64, 0x65,
 	0x49, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x08, 0x6e, 0x73, 0x4e, 0x6f, 0x64, 0x65,
 	0x49, 0x64, 0x12, 0x1e, 0x0a, 0x0a, 0x6e, 0x73, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x49, 0x64,
@@ -221,8 +229,9 @@ var file_models_model_ns_access_log_proto_rawDesc = []byte{
 	0x71, 0x75, 0x65, 0x73, 0x74, 0x49, 0x64, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x72,
 	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x49, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x74, 0x69, 0x6d, 0x65,
 	0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x74, 0x69, 0x6d,
-	0x65, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x42, 0x06, 0x5a, 0x04, 0x2e, 0x2f, 0x70, 0x62, 0x62, 0x06,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x65, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18,
+	0x10, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x42, 0x06, 0x5a, 0x04,
+	0x2e, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/pkg/rpc/pb/model_ns_domain.pb.go b/pkg/rpc/pb/model_ns_domain.pb.go
index 2f1ef44..abc9460 100644
--- a/pkg/rpc/pb/model_ns_domain.pb.go
+++ b/pkg/rpc/pb/model_ns_domain.pb.go
@@ -37,6 +37,7 @@ type NSDomain struct {
 	CreatedAt int64      `protobuf:"varint,4,opt,name=createdAt,proto3" json:"createdAt,omitempty"`
 	IsDeleted bool       `protobuf:"varint,5,opt,name=isDeleted,proto3" json:"isDeleted,omitempty"`
 	Version   int64      `protobuf:"varint,6,opt,name=version,proto3" json:"version,omitempty"`
+	TsigJSON  []byte     `protobuf:"bytes,7,opt,name=tsigJSON,proto3" json:"tsigJSON,omitempty"`
 	NsCluster *NSCluster `protobuf:"bytes,30,opt,name=nsCluster,proto3" json:"nsCluster,omitempty"`
 	User      *User      `protobuf:"bytes,31,opt,name=user,proto3" json:"user,omitempty"`
 }
@@ -115,6 +116,13 @@ func (x *NSDomain) GetVersion() int64 {
 	return 0
 }
 
+func (x *NSDomain) GetTsigJSON() []byte {
+	if x != nil {
+		return x.TsigJSON
+	}
+	return nil
+}
+
 func (x *NSDomain) GetNsCluster() *NSCluster {
 	if x != nil {
 		return x.NsCluster
@@ -137,7 +145,7 @@ var file_models_model_ns_domain_proto_rawDesc = []byte{
 	0x70, 0x62, 0x1a, 0x1d, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x73, 0x2f, 0x6d, 0x6f, 0x64, 0x65, 0x6c,
 	0x5f, 0x6e, 0x73, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74,
 	0x6f, 0x1a, 0x17, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x73, 0x2f, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x5f,
-	0x75, 0x73, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xe3, 0x01, 0x0a, 0x08, 0x4e,
+	0x75, 0x73, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xff, 0x01, 0x0a, 0x08, 0x4e,
 	0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
 	0x01, 0x28, 0x03, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
 	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x69,
@@ -147,12 +155,14 @@ var file_models_model_ns_domain_proto_rawDesc = []byte{
 	0x09, 0x69, 0x73, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08,
 	0x52, 0x09, 0x69, 0x73, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76,
 	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x03, 0x52, 0x07, 0x76, 0x65,
-	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2b, 0x0a, 0x09, 0x6e, 0x73, 0x43, 0x6c, 0x75, 0x73, 0x74,
-	0x65, 0x72, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x70, 0x62, 0x2e, 0x4e, 0x53,
-	0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x52, 0x09, 0x6e, 0x73, 0x43, 0x6c, 0x75, 0x73, 0x74,
-	0x65, 0x72, 0x12, 0x1c, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72, 0x18, 0x1f, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x08, 0x2e, 0x70, 0x62, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72,
-	0x42, 0x06, 0x5a, 0x04, 0x2e, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x74, 0x73, 0x69, 0x67, 0x4a, 0x53, 0x4f,
+	0x4e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x74, 0x73, 0x69, 0x67, 0x4a, 0x53, 0x4f,
+	0x4e, 0x12, 0x2b, 0x0a, 0x09, 0x6e, 0x73, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x18, 0x1e,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x70, 0x62, 0x2e, 0x4e, 0x53, 0x43, 0x6c, 0x75, 0x73,
+	0x74, 0x65, 0x72, 0x52, 0x09, 0x6e, 0x73, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x1c,
+	0x0a, 0x04, 0x75, 0x73, 0x65, 0x72, 0x18, 0x1f, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x08, 0x2e, 0x70,
+	0x62, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x42, 0x06, 0x5a, 0x04,
+	0x2e, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/pkg/rpc/pb/model_ns_key.pb.go b/pkg/rpc/pb/model_ns_key.pb.go
index 68e321b..f518442 100644
--- a/pkg/rpc/pb/model_ns_key.pb.go
+++ b/pkg/rpc/pb/model_ns_key.pb.go
@@ -31,12 +31,16 @@ type NSKey struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Id         int64  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
-	IsOn       bool   `protobuf:"varint,2,opt,name=isOn,proto3" json:"isOn,omitempty"`
-	Name       string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
-	Algo       string `protobuf:"bytes,4,opt,name=algo,proto3" json:"algo,omitempty"`
-	Secret     string `protobuf:"bytes,5,opt,name=secret,proto3" json:"secret,omitempty"`
-	SecretType string `protobuf:"bytes,6,opt,name=secretType,proto3" json:"secretType,omitempty"`
+	Id         int64     `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	IsOn       bool      `protobuf:"varint,2,opt,name=isOn,proto3" json:"isOn,omitempty"`
+	Name       string    `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
+	Algo       string    `protobuf:"bytes,4,opt,name=algo,proto3" json:"algo,omitempty"`
+	Secret     string    `protobuf:"bytes,5,opt,name=secret,proto3" json:"secret,omitempty"`
+	SecretType string    `protobuf:"bytes,6,opt,name=secretType,proto3" json:"secretType,omitempty"`
+	IsDeleted  bool      `protobuf:"varint,7,opt,name=isDeleted,proto3" json:"isDeleted,omitempty"`
+	Version    int64     `protobuf:"varint,8,opt,name=version,proto3" json:"version,omitempty"`
+	NsDomain   *NSDomain `protobuf:"bytes,30,opt,name=nsDomain,proto3" json:"nsDomain,omitempty"`
+	NsZone     *NSZone   `protobuf:"bytes,31,opt,name=nsZone,proto3" json:"nsZone,omitempty"`
 }
 
 func (x *NSKey) Reset() {
@@ -113,20 +117,60 @@ func (x *NSKey) GetSecretType() string {
 	return ""
 }
 
+func (x *NSKey) GetIsDeleted() bool {
+	if x != nil {
+		return x.IsDeleted
+	}
+	return false
+}
+
+func (x *NSKey) GetVersion() int64 {
+	if x != nil {
+		return x.Version
+	}
+	return 0
+}
+
+func (x *NSKey) GetNsDomain() *NSDomain {
+	if x != nil {
+		return x.NsDomain
+	}
+	return nil
+}
+
+func (x *NSKey) GetNsZone() *NSZone {
+	if x != nil {
+		return x.NsZone
+	}
+	return nil
+}
+
 var File_models_model_ns_key_proto protoreflect.FileDescriptor
 
 var file_models_model_ns_key_proto_rawDesc = []byte{
 	0x0a, 0x19, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x73, 0x2f, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x5f, 0x6e,
-	0x73, 0x5f, 0x6b, 0x65, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x02, 0x70, 0x62, 0x22,
-	0x8b, 0x01, 0x0a, 0x05, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x73, 0x4f,
-	0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x04, 0x69, 0x73, 0x4f, 0x6e, 0x12, 0x12, 0x0a,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d,
-	0x65, 0x12, 0x12, 0x0a, 0x04, 0x61, 0x6c, 0x67, 0x6f, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x61, 0x6c, 0x67, 0x6f, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x1e, 0x0a,
-	0x0a, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x54, 0x79, 0x70, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0a, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x54, 0x79, 0x70, 0x65, 0x42, 0x06, 0x5a,
+	0x73, 0x5f, 0x6b, 0x65, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x02, 0x70, 0x62, 0x1a,
+	0x1c, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x73, 0x2f, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x5f, 0x6e, 0x73,
+	0x5f, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1a, 0x6d,
+	0x6f, 0x64, 0x65, 0x6c, 0x73, 0x2f, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x5f, 0x6e, 0x73, 0x5f, 0x7a,
+	0x6f, 0x6e, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x91, 0x02, 0x0a, 0x05, 0x4e, 0x53,
+	0x4b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52,
+	0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x73, 0x4f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x04, 0x69, 0x73, 0x4f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x61,
+	0x6c, 0x67, 0x6f, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x61, 0x6c, 0x67, 0x6f, 0x12,
+	0x16, 0x0a, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x65, 0x63, 0x72, 0x65,
+	0x74, 0x54, 0x79, 0x70, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x63,
+	0x72, 0x65, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x69, 0x73, 0x44, 0x65, 0x6c,
+	0x65, 0x74, 0x65, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x69, 0x73, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
+	0x18, 0x08, 0x20, 0x01, 0x28, 0x03, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
+	0x28, 0x0a, 0x08, 0x6e, 0x73, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x1e, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x0c, 0x2e, 0x70, 0x62, 0x2e, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52,
+	0x08, 0x6e, 0x73, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x22, 0x0a, 0x06, 0x6e, 0x73, 0x5a,
+	0x6f, 0x6e, 0x65, 0x18, 0x1f, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0a, 0x2e, 0x70, 0x62, 0x2e, 0x4e,
+	0x53, 0x5a, 0x6f, 0x6e, 0x65, 0x52, 0x06, 0x6e, 0x73, 0x5a, 0x6f, 0x6e, 0x65, 0x42, 0x06, 0x5a,
 	0x04, 0x2e, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
@@ -144,14 +188,18 @@ func file_models_model_ns_key_proto_rawDescGZIP() []byte {
 
 var file_models_model_ns_key_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
 var file_models_model_ns_key_proto_goTypes = []interface{}{
-	(*NSKey)(nil), // 0: pb.NSKey
+	(*NSKey)(nil),    // 0: pb.NSKey
+	(*NSDomain)(nil), // 1: pb.NSDomain
+	(*NSZone)(nil),   // 2: pb.NSZone
 }
 var file_models_model_ns_key_proto_depIdxs = []int32{
-	0, // [0:0] is the sub-list for method output_type
-	0, // [0:0] is the sub-list for method input_type
-	0, // [0:0] is the sub-list for extension type_name
-	0, // [0:0] is the sub-list for extension extendee
-	0, // [0:0] is the sub-list for field type_name
+	1, // 0: pb.NSKey.nsDomain:type_name -> pb.NSDomain
+	2, // 1: pb.NSKey.nsZone:type_name -> pb.NSZone
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
 }
 
 func init() { file_models_model_ns_key_proto_init() }
@@ -159,6 +207,8 @@ func file_models_model_ns_key_proto_init() {
 	if File_models_model_ns_key_proto != nil {
 		return
 	}
+	file_models_model_ns_domain_proto_init()
+	file_models_model_ns_zone_proto_init()
 	if !protoimpl.UnsafeEnabled {
 		file_models_model_ns_key_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*NSKey); i {
diff --git a/pkg/rpc/pb/model_ns_zone.pb.go b/pkg/rpc/pb/model_ns_zone.pb.go
new file mode 100644
index 0000000..a482a0b
--- /dev/null
+++ b/pkg/rpc/pb/model_ns_zone.pb.go
@@ -0,0 +1,147 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.25.0
+// 	protoc        v3.12.3
+// source: models/model_ns_zone.proto
+
+package pb
+
+import (
+	proto "github.com/golang/protobuf/proto"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// This is a compile-time assertion that a sufficiently up-to-date version
+// of the legacy proto package is being used.
+const _ = proto.ProtoPackageIsVersion4
+
+// DNS子域
+type NSZone struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id int64 `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+}
+
+func (x *NSZone) Reset() {
+	*x = NSZone{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_models_model_ns_zone_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *NSZone) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NSZone) ProtoMessage() {}
+
+func (x *NSZone) ProtoReflect() protoreflect.Message {
+	mi := &file_models_model_ns_zone_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NSZone.ProtoReflect.Descriptor instead.
+func (*NSZone) Descriptor() ([]byte, []int) {
+	return file_models_model_ns_zone_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *NSZone) GetId() int64 {
+	if x != nil {
+		return x.Id
+	}
+	return 0
+}
+
+var File_models_model_ns_zone_proto protoreflect.FileDescriptor
+
+var file_models_model_ns_zone_proto_rawDesc = []byte{
+	0x0a, 0x1a, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x73, 0x2f, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x5f, 0x6e,
+	0x73, 0x5f, 0x7a, 0x6f, 0x6e, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x02, 0x70, 0x62,
+	0x22, 0x18, 0x0a, 0x06, 0x4e, 0x53, 0x5a, 0x6f, 0x6e, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x02, 0x69, 0x64, 0x42, 0x06, 0x5a, 0x04, 0x2e, 0x2f,
+	0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_models_model_ns_zone_proto_rawDescOnce sync.Once
+	file_models_model_ns_zone_proto_rawDescData = file_models_model_ns_zone_proto_rawDesc
+)
+
+func file_models_model_ns_zone_proto_rawDescGZIP() []byte {
+	file_models_model_ns_zone_proto_rawDescOnce.Do(func() {
+		file_models_model_ns_zone_proto_rawDescData = protoimpl.X.CompressGZIP(file_models_model_ns_zone_proto_rawDescData)
+	})
+	return file_models_model_ns_zone_proto_rawDescData
+}
+
+var file_models_model_ns_zone_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_models_model_ns_zone_proto_goTypes = []interface{}{
+	(*NSZone)(nil), // 0: pb.NSZone
+}
+var file_models_model_ns_zone_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_models_model_ns_zone_proto_init() }
+func file_models_model_ns_zone_proto_init() {
+	if File_models_model_ns_zone_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_models_model_ns_zone_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*NSZone); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_models_model_ns_zone_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_models_model_ns_zone_proto_goTypes,
+		DependencyIndexes: file_models_model_ns_zone_proto_depIdxs,
+		MessageInfos:      file_models_model_ns_zone_proto_msgTypes,
+	}.Build()
+	File_models_model_ns_zone_proto = out.File
+	file_models_model_ns_zone_proto_rawDesc = nil
+	file_models_model_ns_zone_proto_goTypes = nil
+	file_models_model_ns_zone_proto_depIdxs = nil
+}
diff --git a/pkg/rpc/pb/service_ns_domain.pb.go b/pkg/rpc/pb/service_ns_domain.pb.go
index d26eccc..7585391 100644
--- a/pkg/rpc/pb/service_ns_domain.pb.go
+++ b/pkg/rpc/pb/service_ns_domain.pb.go
@@ -650,6 +650,157 @@ func (x *ListNSDomainsAfterVersionResponse) GetNsDomains() []*NSDomain {
 	return nil
 }
 
+// 查找TSIG配置
+type FindEnabledNSDomainTSIGRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	NsDomainId int64 `protobuf:"varint,1,opt,name=nsDomainId,proto3" json:"nsDomainId,omitempty"`
+}
+
+func (x *FindEnabledNSDomainTSIGRequest) Reset() {
+	*x = FindEnabledNSDomainTSIGRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_service_ns_domain_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *FindEnabledNSDomainTSIGRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*FindEnabledNSDomainTSIGRequest) ProtoMessage() {}
+
+func (x *FindEnabledNSDomainTSIGRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_service_ns_domain_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use FindEnabledNSDomainTSIGRequest.ProtoReflect.Descriptor instead.
+func (*FindEnabledNSDomainTSIGRequest) Descriptor() ([]byte, []int) {
+	return file_service_ns_domain_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *FindEnabledNSDomainTSIGRequest) GetNsDomainId() int64 {
+	if x != nil {
+		return x.NsDomainId
+	}
+	return 0
+}
+
+type FindEnabledNSDomainTSIGResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	TsigJSON []byte `protobuf:"bytes,1,opt,name=tsigJSON,proto3" json:"tsigJSON,omitempty"`
+}
+
+func (x *FindEnabledNSDomainTSIGResponse) Reset() {
+	*x = FindEnabledNSDomainTSIGResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_service_ns_domain_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *FindEnabledNSDomainTSIGResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*FindEnabledNSDomainTSIGResponse) ProtoMessage() {}
+
+func (x *FindEnabledNSDomainTSIGResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_service_ns_domain_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use FindEnabledNSDomainTSIGResponse.ProtoReflect.Descriptor instead.
+func (*FindEnabledNSDomainTSIGResponse) Descriptor() ([]byte, []int) {
+	return file_service_ns_domain_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *FindEnabledNSDomainTSIGResponse) GetTsigJSON() []byte {
+	if x != nil {
+		return x.TsigJSON
+	}
+	return nil
+}
+
+// 修改TSIG配置
+type UpdateNSDomainTSIGRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	NsDomainId int64  `protobuf:"varint,1,opt,name=nsDomainId,proto3" json:"nsDomainId,omitempty"`
+	TsigJSON   []byte `protobuf:"bytes,2,opt,name=tsigJSON,proto3" json:"tsigJSON,omitempty"`
+}
+
+func (x *UpdateNSDomainTSIGRequest) Reset() {
+	*x = UpdateNSDomainTSIGRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_service_ns_domain_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdateNSDomainTSIGRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateNSDomainTSIGRequest) ProtoMessage() {}
+
+func (x *UpdateNSDomainTSIGRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_service_ns_domain_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateNSDomainTSIGRequest.ProtoReflect.Descriptor instead.
+func (*UpdateNSDomainTSIGRequest) Descriptor() ([]byte, []int) {
+	return file_service_ns_domain_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *UpdateNSDomainTSIGRequest) GetNsDomainId() int64 {
+	if x != nil {
+		return x.NsDomainId
+	}
+	return 0
+}
+
+func (x *UpdateNSDomainTSIGRequest) GetTsigJSON() []byte {
+	if x != nil {
+		return x.TsigJSON
+	}
+	return nil
+}
+
 var File_service_ns_domain_proto protoreflect.FileDescriptor
 
 var file_service_ns_domain_proto_rawDesc = []byte{
@@ -721,44 +872,69 @@ var file_service_ns_domain_proto_rawDesc = []byte{
 	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2a, 0x0a, 0x09, 0x6e, 0x73, 0x44,
 	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0c, 0x2e, 0x70,
 	0x62, 0x2e, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x09, 0x6e, 0x73, 0x44, 0x6f,
-	0x6d, 0x61, 0x69, 0x6e, 0x73, 0x32, 0xc8, 0x04, 0x0a, 0x0f, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x47, 0x0a, 0x0e, 0x63, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x19, 0x2e, 0x70, 0x62,
-	0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a, 0x2e, 0x70, 0x62, 0x2e, 0x43, 0x72, 0x65, 0x61,
-	0x74, 0x65, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x3b, 0x0a, 0x0e, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4e, 0x53, 0x44, 0x6f,
-	0x6d, 0x61, 0x69, 0x6e, 0x12, 0x19, 0x2e, 0x70, 0x62, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
-	0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x0e, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x50, 0x43, 0x53, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12,
-	0x3b, 0x0a, 0x0e, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69,
-	0x6e, 0x12, 0x19, 0x2e, 0x70, 0x62, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4e, 0x53, 0x44,
-	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x0e, 0x2e, 0x70,
-	0x62, 0x2e, 0x52, 0x50, 0x43, 0x53, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x56, 0x0a, 0x13,
-	0x66, 0x69, 0x6e, 0x64, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x44, 0x6f, 0x6d,
-	0x61, 0x69, 0x6e, 0x12, 0x1e, 0x2e, 0x70, 0x62, 0x2e, 0x46, 0x69, 0x6e, 0x64, 0x45, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x70, 0x62, 0x2e, 0x46, 0x69, 0x6e, 0x64, 0x45, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x55, 0x0a, 0x18, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x41, 0x6c, 0x6c,
-	0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73,
-	0x12, 0x23, 0x2e, 0x70, 0x62, 0x2e, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x41, 0x6c, 0x6c, 0x45, 0x6e,
-	0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x14, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x50, 0x43, 0x43, 0x6f,
-	0x75, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x59, 0x0a, 0x14, 0x6c,
-	0x69, 0x73, 0x74, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x73, 0x12, 0x1f, 0x2e, 0x70, 0x62, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x45, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x70, 0x62, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x45, 0x6e,
-	0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x68, 0x0a, 0x19, 0x6c, 0x69, 0x73, 0x74, 0x4e, 0x53,
-	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x41, 0x66, 0x74, 0x65, 0x72, 0x56, 0x65, 0x72, 0x73,
-	0x69, 0x6f, 0x6e, 0x12, 0x24, 0x2e, 0x70, 0x62, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4e, 0x53, 0x44,
+	0x6d, 0x61, 0x69, 0x6e, 0x73, 0x22, 0x40, 0x0a, 0x1e, 0x46, 0x69, 0x6e, 0x64, 0x45, 0x6e, 0x61,
+	0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x54, 0x53, 0x49, 0x47,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1e, 0x0a, 0x0a, 0x6e, 0x73, 0x44, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x49, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0a, 0x6e, 0x73, 0x44,
+	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x49, 0x64, 0x22, 0x3d, 0x0a, 0x1f, 0x46, 0x69, 0x6e, 0x64, 0x45,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x54, 0x53,
+	0x49, 0x47, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x74, 0x73,
+	0x69, 0x67, 0x4a, 0x53, 0x4f, 0x4e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x74, 0x73,
+	0x69, 0x67, 0x4a, 0x53, 0x4f, 0x4e, 0x22, 0x57, 0x0a, 0x19, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x54, 0x53, 0x49, 0x47, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x1e, 0x0a, 0x0a, 0x6e, 0x73, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x49,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0a, 0x6e, 0x73, 0x44, 0x6f, 0x6d, 0x61, 0x69,
+	0x6e, 0x49, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x74, 0x73, 0x69, 0x67, 0x4a, 0x53, 0x4f, 0x4e, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x74, 0x73, 0x69, 0x67, 0x4a, 0x53, 0x4f, 0x4e, 0x32,
+	0xf1, 0x05, 0x0a, 0x0f, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x12, 0x47, 0x0a, 0x0e, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x53, 0x44,
+	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x19, 0x2e, 0x70, 0x62, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x1a, 0x2e, 0x70, 0x62, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x53, 0x44, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3b, 0x0a, 0x0e,
+	0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x19,
+	0x2e, 0x70, 0x62, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x0e, 0x2e, 0x70, 0x62, 0x2e, 0x52,
+	0x50, 0x43, 0x53, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x3b, 0x0a, 0x0e, 0x64, 0x65, 0x6c,
+	0x65, 0x74, 0x65, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x19, 0x2e, 0x70, 0x62,
+	0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x0e, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x50, 0x43, 0x53,
+	0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x56, 0x0a, 0x13, 0x66, 0x69, 0x6e, 0x64, 0x45, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x1e, 0x2e,
+	0x70, 0x62, 0x2e, 0x46, 0x69, 0x6e, 0x64, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e,
+	0x70, 0x62, 0x2e, 0x46, 0x69, 0x6e, 0x64, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x55,
+	0x0a, 0x18, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x41, 0x6c, 0x6c, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x64, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x23, 0x2e, 0x70, 0x62, 0x2e,
+	0x43, 0x6f, 0x75, 0x6e, 0x74, 0x41, 0x6c, 0x6c, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e,
+	0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x14, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x50, 0x43, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x59, 0x0a, 0x14, 0x6c, 0x69, 0x73, 0x74, 0x45, 0x6e, 0x61,
+	0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x1f, 0x2e,
+	0x70, 0x62, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20,
+	0x2e, 0x70, 0x62, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e,
+	0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x68, 0x0a, 0x19, 0x6c, 0x69, 0x73, 0x74, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x73, 0x41, 0x66, 0x74, 0x65, 0x72, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x24, 0x2e,
+	0x70, 0x62, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73,
+	0x41, 0x66, 0x74, 0x65, 0x72, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x70, 0x62, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4e, 0x53, 0x44,
 	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x41, 0x66, 0x74, 0x65, 0x72, 0x56, 0x65, 0x72, 0x73, 0x69,
-	0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x70, 0x62, 0x2e, 0x4c,
-	0x69, 0x73, 0x74, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x41, 0x66, 0x74, 0x65,
-	0x72, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x42, 0x06, 0x5a, 0x04, 0x2e, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x62, 0x0a, 0x17, 0x66, 0x69,
+	0x6e, 0x64, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69,
+	0x6e, 0x54, 0x53, 0x49, 0x47, 0x12, 0x22, 0x2e, 0x70, 0x62, 0x2e, 0x46, 0x69, 0x6e, 0x64, 0x45,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x54, 0x53,
+	0x49, 0x47, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x62, 0x2e, 0x46,
+	0x69, 0x6e, 0x64, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x54, 0x53, 0x49, 0x47, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x43,
+	0x0a, 0x12, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x54, 0x53, 0x49, 0x47, 0x12, 0x1d, 0x2e, 0x70, 0x62, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x4e, 0x53, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x54, 0x53, 0x49, 0x47, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x0e, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x50, 0x43, 0x53, 0x75, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x42, 0x06, 0x5a, 0x04, 0x2e, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x33,
 }
 
 var (
@@ -773,7 +949,7 @@ func file_service_ns_domain_proto_rawDescGZIP() []byte {
 	return file_service_ns_domain_proto_rawDescData
 }
 
-var file_service_ns_domain_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
+var file_service_ns_domain_proto_msgTypes = make([]protoimpl.MessageInfo, 14)
 var file_service_ns_domain_proto_goTypes = []interface{}{
 	(*CreateNSDomainRequest)(nil),             // 0: pb.CreateNSDomainRequest
 	(*CreateNSDomainResponse)(nil),            // 1: pb.CreateNSDomainResponse
@@ -786,14 +962,17 @@ var file_service_ns_domain_proto_goTypes = []interface{}{
 	(*ListEnabledNSDomainsResponse)(nil),      // 8: pb.ListEnabledNSDomainsResponse
 	(*ListNSDomainsAfterVersionRequest)(nil),  // 9: pb.ListNSDomainsAfterVersionRequest
 	(*ListNSDomainsAfterVersionResponse)(nil), // 10: pb.ListNSDomainsAfterVersionResponse
-	(*NSDomain)(nil),                          // 11: pb.NSDomain
-	(*RPCSuccess)(nil),                        // 12: pb.RPCSuccess
-	(*RPCCountResponse)(nil),                  // 13: pb.RPCCountResponse
+	(*FindEnabledNSDomainTSIGRequest)(nil),    // 11: pb.FindEnabledNSDomainTSIGRequest
+	(*FindEnabledNSDomainTSIGResponse)(nil),   // 12: pb.FindEnabledNSDomainTSIGResponse
+	(*UpdateNSDomainTSIGRequest)(nil),         // 13: pb.UpdateNSDomainTSIGRequest
+	(*NSDomain)(nil),                          // 14: pb.NSDomain
+	(*RPCSuccess)(nil),                        // 15: pb.RPCSuccess
+	(*RPCCountResponse)(nil),                  // 16: pb.RPCCountResponse
 }
 var file_service_ns_domain_proto_depIdxs = []int32{
-	11, // 0: pb.FindEnabledNSDomainResponse.nsDomain:type_name -> pb.NSDomain
-	11, // 1: pb.ListEnabledNSDomainsResponse.nsDomains:type_name -> pb.NSDomain
-	11, // 2: pb.ListNSDomainsAfterVersionResponse.nsDomains:type_name -> pb.NSDomain
+	14, // 0: pb.FindEnabledNSDomainResponse.nsDomain:type_name -> pb.NSDomain
+	14, // 1: pb.ListEnabledNSDomainsResponse.nsDomains:type_name -> pb.NSDomain
+	14, // 2: pb.ListNSDomainsAfterVersionResponse.nsDomains:type_name -> pb.NSDomain
 	0,  // 3: pb.NSDomainService.createNSDomain:input_type -> pb.CreateNSDomainRequest
 	2,  // 4: pb.NSDomainService.updateNSDomain:input_type -> pb.UpdateNSDomainRequest
 	3,  // 5: pb.NSDomainService.deleteNSDomain:input_type -> pb.DeleteNSDomainRequest
@@ -801,15 +980,19 @@ var file_service_ns_domain_proto_depIdxs = []int32{
 	6,  // 7: pb.NSDomainService.countAllEnabledNSDomains:input_type -> pb.CountAllEnabledNSDomainsRequest
 	7,  // 8: pb.NSDomainService.listEnabledNSDomains:input_type -> pb.ListEnabledNSDomainsRequest
 	9,  // 9: pb.NSDomainService.listNSDomainsAfterVersion:input_type -> pb.ListNSDomainsAfterVersionRequest
-	1,  // 10: pb.NSDomainService.createNSDomain:output_type -> pb.CreateNSDomainResponse
-	12, // 11: pb.NSDomainService.updateNSDomain:output_type -> pb.RPCSuccess
-	12, // 12: pb.NSDomainService.deleteNSDomain:output_type -> pb.RPCSuccess
-	5,  // 13: pb.NSDomainService.findEnabledNSDomain:output_type -> pb.FindEnabledNSDomainResponse
-	13, // 14: pb.NSDomainService.countAllEnabledNSDomains:output_type -> pb.RPCCountResponse
-	8,  // 15: pb.NSDomainService.listEnabledNSDomains:output_type -> pb.ListEnabledNSDomainsResponse
-	10, // 16: pb.NSDomainService.listNSDomainsAfterVersion:output_type -> pb.ListNSDomainsAfterVersionResponse
-	10, // [10:17] is the sub-list for method output_type
-	3,  // [3:10] is the sub-list for method input_type
+	11, // 10: pb.NSDomainService.findEnabledNSDomainTSIG:input_type -> pb.FindEnabledNSDomainTSIGRequest
+	13, // 11: pb.NSDomainService.updateNSDomainTSIG:input_type -> pb.UpdateNSDomainTSIGRequest
+	1,  // 12: pb.NSDomainService.createNSDomain:output_type -> pb.CreateNSDomainResponse
+	15, // 13: pb.NSDomainService.updateNSDomain:output_type -> pb.RPCSuccess
+	15, // 14: pb.NSDomainService.deleteNSDomain:output_type -> pb.RPCSuccess
+	5,  // 15: pb.NSDomainService.findEnabledNSDomain:output_type -> pb.FindEnabledNSDomainResponse
+	16, // 16: pb.NSDomainService.countAllEnabledNSDomains:output_type -> pb.RPCCountResponse
+	8,  // 17: pb.NSDomainService.listEnabledNSDomains:output_type -> pb.ListEnabledNSDomainsResponse
+	10, // 18: pb.NSDomainService.listNSDomainsAfterVersion:output_type -> pb.ListNSDomainsAfterVersionResponse
+	12, // 19: pb.NSDomainService.findEnabledNSDomainTSIG:output_type -> pb.FindEnabledNSDomainTSIGResponse
+	15, // 20: pb.NSDomainService.updateNSDomainTSIG:output_type -> pb.RPCSuccess
+	12, // [12:21] is the sub-list for method output_type
+	3,  // [3:12] is the sub-list for method input_type
 	3,  // [3:3] is the sub-list for extension type_name
 	3,  // [3:3] is the sub-list for extension extendee
 	0,  // [0:3] is the sub-list for field type_name
@@ -955,6 +1138,42 @@ func file_service_ns_domain_proto_init() {
 				return nil
 			}
 		}
+		file_service_ns_domain_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*FindEnabledNSDomainTSIGRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_service_ns_domain_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*FindEnabledNSDomainTSIGResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_service_ns_domain_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpdateNSDomainTSIGRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
@@ -962,7 +1181,7 @@ func file_service_ns_domain_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_service_ns_domain_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   11,
+			NumMessages:   14,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
@@ -1002,6 +1221,10 @@ type NSDomainServiceClient interface {
 	ListEnabledNSDomains(ctx context.Context, in *ListEnabledNSDomainsRequest, opts ...grpc.CallOption) (*ListEnabledNSDomainsResponse, error)
 	// 根据版本列出一组域名
 	ListNSDomainsAfterVersion(ctx context.Context, in *ListNSDomainsAfterVersionRequest, opts ...grpc.CallOption) (*ListNSDomainsAfterVersionResponse, error)
+	// 查找TSIG配置
+	FindEnabledNSDomainTSIG(ctx context.Context, in *FindEnabledNSDomainTSIGRequest, opts ...grpc.CallOption) (*FindEnabledNSDomainTSIGResponse, error)
+	// 修改TSIG配置
+	UpdateNSDomainTSIG(ctx context.Context, in *UpdateNSDomainTSIGRequest, opts ...grpc.CallOption) (*RPCSuccess, error)
 }
 
 type nSDomainServiceClient struct {
@@ -1075,6 +1298,24 @@ func (c *nSDomainServiceClient) ListNSDomainsAfterVersion(ctx context.Context, i
 	return out, nil
 }
 
+func (c *nSDomainServiceClient) FindEnabledNSDomainTSIG(ctx context.Context, in *FindEnabledNSDomainTSIGRequest, opts ...grpc.CallOption) (*FindEnabledNSDomainTSIGResponse, error) {
+	out := new(FindEnabledNSDomainTSIGResponse)
+	err := c.cc.Invoke(ctx, "/pb.NSDomainService/findEnabledNSDomainTSIG", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *nSDomainServiceClient) UpdateNSDomainTSIG(ctx context.Context, in *UpdateNSDomainTSIGRequest, opts ...grpc.CallOption) (*RPCSuccess, error) {
+	out := new(RPCSuccess)
+	err := c.cc.Invoke(ctx, "/pb.NSDomainService/updateNSDomainTSIG", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // NSDomainServiceServer is the server API for NSDomainService service.
 type NSDomainServiceServer interface {
 	// 创建域名
@@ -1091,6 +1332,10 @@ type NSDomainServiceServer interface {
 	ListEnabledNSDomains(context.Context, *ListEnabledNSDomainsRequest) (*ListEnabledNSDomainsResponse, error)
 	// 根据版本列出一组域名
 	ListNSDomainsAfterVersion(context.Context, *ListNSDomainsAfterVersionRequest) (*ListNSDomainsAfterVersionResponse, error)
+	// 查找TSIG配置
+	FindEnabledNSDomainTSIG(context.Context, *FindEnabledNSDomainTSIGRequest) (*FindEnabledNSDomainTSIGResponse, error)
+	// 修改TSIG配置
+	UpdateNSDomainTSIG(context.Context, *UpdateNSDomainTSIGRequest) (*RPCSuccess, error)
 }
 
 // UnimplementedNSDomainServiceServer can be embedded to have forward compatible implementations.
@@ -1118,6 +1363,12 @@ func (*UnimplementedNSDomainServiceServer) ListEnabledNSDomains(context.Context,
 func (*UnimplementedNSDomainServiceServer) ListNSDomainsAfterVersion(context.Context, *ListNSDomainsAfterVersionRequest) (*ListNSDomainsAfterVersionResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListNSDomainsAfterVersion not implemented")
 }
+func (*UnimplementedNSDomainServiceServer) FindEnabledNSDomainTSIG(context.Context, *FindEnabledNSDomainTSIGRequest) (*FindEnabledNSDomainTSIGResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method FindEnabledNSDomainTSIG not implemented")
+}
+func (*UnimplementedNSDomainServiceServer) UpdateNSDomainTSIG(context.Context, *UpdateNSDomainTSIGRequest) (*RPCSuccess, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpdateNSDomainTSIG not implemented")
+}
 
 func RegisterNSDomainServiceServer(s *grpc.Server, srv NSDomainServiceServer) {
 	s.RegisterService(&_NSDomainService_serviceDesc, srv)
@@ -1249,6 +1500,42 @@ func _NSDomainService_ListNSDomainsAfterVersion_Handler(srv interface{}, ctx con
 	return interceptor(ctx, in, info, handler)
 }
 
+func _NSDomainService_FindEnabledNSDomainTSIG_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(FindEnabledNSDomainTSIGRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NSDomainServiceServer).FindEnabledNSDomainTSIG(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/pb.NSDomainService/FindEnabledNSDomainTSIG",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NSDomainServiceServer).FindEnabledNSDomainTSIG(ctx, req.(*FindEnabledNSDomainTSIGRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _NSDomainService_UpdateNSDomainTSIG_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateNSDomainTSIGRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NSDomainServiceServer).UpdateNSDomainTSIG(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/pb.NSDomainService/UpdateNSDomainTSIG",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NSDomainServiceServer).UpdateNSDomainTSIG(ctx, req.(*UpdateNSDomainTSIGRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 var _NSDomainService_serviceDesc = grpc.ServiceDesc{
 	ServiceName: "pb.NSDomainService",
 	HandlerType: (*NSDomainServiceServer)(nil),
@@ -1281,6 +1568,14 @@ var _NSDomainService_serviceDesc = grpc.ServiceDesc{
 			MethodName: "listNSDomainsAfterVersion",
 			Handler:    _NSDomainService_ListNSDomainsAfterVersion_Handler,
 		},
+		{
+			MethodName: "findEnabledNSDomainTSIG",
+			Handler:    _NSDomainService_FindEnabledNSDomainTSIG_Handler,
+		},
+		{
+			MethodName: "updateNSDomainTSIG",
+			Handler:    _NSDomainService_UpdateNSDomainTSIG_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "service_ns_domain.proto",
diff --git a/pkg/rpc/pb/service_ns_key.pb.go b/pkg/rpc/pb/service_ns_key.pb.go
index 44ad4f2..9f0b176 100644
--- a/pkg/rpc/pb/service_ns_key.pb.go
+++ b/pkg/rpc/pb/service_ns_key.pb.go
@@ -570,6 +570,109 @@ func (x *ListEnabledNSKeysResponse) GetNsKeys() []*NSKey {
 	return nil
 }
 
+// 根据版本列出一组密钥
+type ListNSKeysAfterVersionRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Version int64 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
+	Size    int64 `protobuf:"varint,2,opt,name=size,proto3" json:"size,omitempty"`
+}
+
+func (x *ListNSKeysAfterVersionRequest) Reset() {
+	*x = ListNSKeysAfterVersionRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_service_ns_key_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListNSKeysAfterVersionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListNSKeysAfterVersionRequest) ProtoMessage() {}
+
+func (x *ListNSKeysAfterVersionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_service_ns_key_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListNSKeysAfterVersionRequest.ProtoReflect.Descriptor instead.
+func (*ListNSKeysAfterVersionRequest) Descriptor() ([]byte, []int) {
+	return file_service_ns_key_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *ListNSKeysAfterVersionRequest) GetVersion() int64 {
+	if x != nil {
+		return x.Version
+	}
+	return 0
+}
+
+func (x *ListNSKeysAfterVersionRequest) GetSize() int64 {
+	if x != nil {
+		return x.Size
+	}
+	return 0
+}
+
+type ListNSKeysAfterVersionResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	NsKeys []*NSKey `protobuf:"bytes,1,rep,name=nsKeys,proto3" json:"nsKeys,omitempty"`
+}
+
+func (x *ListNSKeysAfterVersionResponse) Reset() {
+	*x = ListNSKeysAfterVersionResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_service_ns_key_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListNSKeysAfterVersionResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListNSKeysAfterVersionResponse) ProtoMessage() {}
+
+func (x *ListNSKeysAfterVersionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_service_ns_key_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListNSKeysAfterVersionResponse.ProtoReflect.Descriptor instead.
+func (*ListNSKeysAfterVersionResponse) Descriptor() ([]byte, []int) {
+	return file_service_ns_key_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *ListNSKeysAfterVersionResponse) GetNsKeys() []*NSKey {
+	if x != nil {
+		return x.NsKeys
+	}
+	return nil
+}
+
 var File_service_ns_key_proto protoreflect.FileDescriptor
 
 var file_service_ns_key_proto_rawDesc = []byte{
@@ -630,35 +733,51 @@ var file_service_ns_key_proto_rawDesc = []byte{
 	0x4c, 0x69, 0x73, 0x74, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x4b, 0x65, 0x79,
 	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x21, 0x0a, 0x06, 0x6e, 0x73, 0x4b,
 	0x65, 0x79, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x4e,
-	0x53, 0x4b, 0x65, 0x79, 0x52, 0x06, 0x6e, 0x73, 0x4b, 0x65, 0x79, 0x73, 0x32, 0xae, 0x03, 0x0a,
-	0x0c, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x3e, 0x0a,
-	0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x12, 0x16, 0x2e, 0x70,
-	0x62, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e, 0x70, 0x62, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x4e, 0x53, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x35, 0x0a,
-	0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x12, 0x16, 0x2e, 0x70,
-	0x62, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x0e, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x50, 0x43, 0x53, 0x75, 0x63,
-	0x63, 0x65, 0x73, 0x73, 0x12, 0x35, 0x0a, 0x0b, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4e, 0x53,
-	0x4b, 0x65, 0x79, 0x12, 0x16, 0x2e, 0x70, 0x62, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4e,
-	0x53, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x0e, 0x2e, 0x70, 0x62,
-	0x2e, 0x52, 0x50, 0x43, 0x53, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x4d, 0x0a, 0x10, 0x66,
-	0x69, 0x6e, 0x64, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x12,
-	0x1b, 0x2e, 0x70, 0x62, 0x2e, 0x46, 0x69, 0x6e, 0x64, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64,
-	0x4e, 0x53, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x70,
-	0x62, 0x2e, 0x46, 0x69, 0x6e, 0x64, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x4b,
-	0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4f, 0x0a, 0x15, 0x63, 0x6f,
-	0x75, 0x6e, 0x74, 0x41, 0x6c, 0x6c, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x4b,
-	0x65, 0x79, 0x73, 0x12, 0x20, 0x2e, 0x70, 0x62, 0x2e, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x41, 0x6c,
-	0x6c, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x14, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x50, 0x43, 0x43, 0x6f,
-	0x75, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x50, 0x0a, 0x11, 0x6c,
-	0x69, 0x73, 0x74, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x73,
-	0x12, 0x1c, 0x2e, 0x70, 0x62, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65,
-	0x64, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d,
-	0x2e, 0x70, 0x62, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e,
-	0x53, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x06, 0x5a,
-	0x04, 0x2e, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x53, 0x4b, 0x65, 0x79, 0x52, 0x06, 0x6e, 0x73, 0x4b, 0x65, 0x79, 0x73, 0x22, 0x4d, 0x0a, 0x1d,
+	0x4c, 0x69, 0x73, 0x74, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x73, 0x41, 0x66, 0x74, 0x65, 0x72, 0x56,
+	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a,
+	0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x07,
+	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x22, 0x43, 0x0a, 0x1e, 0x4c,
+	0x69, 0x73, 0x74, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x73, 0x41, 0x66, 0x74, 0x65, 0x72, 0x56, 0x65,
+	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x21, 0x0a,
+	0x06, 0x6e, 0x73, 0x4b, 0x65, 0x79, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x09, 0x2e,
+	0x70, 0x62, 0x2e, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x52, 0x06, 0x6e, 0x73, 0x4b, 0x65, 0x79, 0x73,
+	0x32, 0x8f, 0x04, 0x0a, 0x0c, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x12, 0x3e, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x53, 0x4b, 0x65, 0x79,
+	0x12, 0x16, 0x2e, 0x70, 0x62, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x53, 0x4b, 0x65,
+	0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e, 0x70, 0x62, 0x2e, 0x43, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x35, 0x0a, 0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4e, 0x53, 0x4b, 0x65, 0x79,
+	0x12, 0x16, 0x2e, 0x70, 0x62, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4e, 0x53, 0x4b, 0x65,
+	0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x0e, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x50,
+	0x43, 0x53, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x35, 0x0a, 0x0b, 0x64, 0x65, 0x6c, 0x65,
+	0x74, 0x65, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x12, 0x16, 0x2e, 0x70, 0x62, 0x2e, 0x44, 0x65, 0x6c,
+	0x65, 0x74, 0x65, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x0e, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x50, 0x43, 0x53, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12,
+	0x4d, 0x0a, 0x10, 0x66, 0x69, 0x6e, 0x64, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53,
+	0x4b, 0x65, 0x79, 0x12, 0x1b, 0x2e, 0x70, 0x62, 0x2e, 0x46, 0x69, 0x6e, 0x64, 0x45, 0x6e, 0x61,
+	0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x1c, 0x2e, 0x70, 0x62, 0x2e, 0x46, 0x69, 0x6e, 0x64, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x64, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4f,
+	0x0a, 0x15, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x41, 0x6c, 0x6c, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x64, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x20, 0x2e, 0x70, 0x62, 0x2e, 0x43, 0x6f, 0x75,
+	0x6e, 0x74, 0x41, 0x6c, 0x6c, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x4b, 0x65,
+	0x79, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x14, 0x2e, 0x70, 0x62, 0x2e, 0x52,
+	0x50, 0x43, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x50, 0x0a, 0x11, 0x6c, 0x69, 0x73, 0x74, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53,
+	0x4b, 0x65, 0x79, 0x73, 0x12, 0x1c, 0x2e, 0x70, 0x62, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x45, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x64, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x70, 0x62, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x45, 0x6e, 0x61, 0x62,
+	0x6c, 0x65, 0x64, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x5f, 0x0a, 0x16, 0x6c, 0x69, 0x73, 0x74, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x73, 0x41,
+	0x66, 0x74, 0x65, 0x72, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x21, 0x2e, 0x70, 0x62,
+	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x73, 0x41, 0x66, 0x74, 0x65, 0x72,
+	0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22,
+	0x2e, 0x70, 0x62, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4e, 0x53, 0x4b, 0x65, 0x79, 0x73, 0x41, 0x66,
+	0x74, 0x65, 0x72, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x42, 0x06, 0x5a, 0x04, 0x2e, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x33,
 }
 
 var (
@@ -673,41 +792,46 @@ func file_service_ns_key_proto_rawDescGZIP() []byte {
 	return file_service_ns_key_proto_rawDescData
 }
 
-var file_service_ns_key_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
+var file_service_ns_key_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
 var file_service_ns_key_proto_goTypes = []interface{}{
-	(*CreateNSKeyRequest)(nil),           // 0: pb.CreateNSKeyRequest
-	(*CreateNSKeyResponse)(nil),          // 1: pb.CreateNSKeyResponse
-	(*UpdateNSKeyRequest)(nil),           // 2: pb.UpdateNSKeyRequest
-	(*DeleteNSKeyRequest)(nil),           // 3: pb.DeleteNSKeyRequest
-	(*FindEnabledNSKeyRequest)(nil),      // 4: pb.FindEnabledNSKeyRequest
-	(*FindEnabledNSKeyResponse)(nil),     // 5: pb.FindEnabledNSKeyResponse
-	(*CountAllEnabledNSKeysRequest)(nil), // 6: pb.CountAllEnabledNSKeysRequest
-	(*ListEnabledNSKeysRequest)(nil),     // 7: pb.ListEnabledNSKeysRequest
-	(*ListEnabledNSKeysResponse)(nil),    // 8: pb.ListEnabledNSKeysResponse
-	(*NSKey)(nil),                        // 9: pb.NSKey
-	(*RPCSuccess)(nil),                   // 10: pb.RPCSuccess
-	(*RPCCountResponse)(nil),             // 11: pb.RPCCountResponse
+	(*CreateNSKeyRequest)(nil),             // 0: pb.CreateNSKeyRequest
+	(*CreateNSKeyResponse)(nil),            // 1: pb.CreateNSKeyResponse
+	(*UpdateNSKeyRequest)(nil),             // 2: pb.UpdateNSKeyRequest
+	(*DeleteNSKeyRequest)(nil),             // 3: pb.DeleteNSKeyRequest
+	(*FindEnabledNSKeyRequest)(nil),        // 4: pb.FindEnabledNSKeyRequest
+	(*FindEnabledNSKeyResponse)(nil),       // 5: pb.FindEnabledNSKeyResponse
+	(*CountAllEnabledNSKeysRequest)(nil),   // 6: pb.CountAllEnabledNSKeysRequest
+	(*ListEnabledNSKeysRequest)(nil),       // 7: pb.ListEnabledNSKeysRequest
+	(*ListEnabledNSKeysResponse)(nil),      // 8: pb.ListEnabledNSKeysResponse
+	(*ListNSKeysAfterVersionRequest)(nil),  // 9: pb.ListNSKeysAfterVersionRequest
+	(*ListNSKeysAfterVersionResponse)(nil), // 10: pb.ListNSKeysAfterVersionResponse
+	(*NSKey)(nil),                          // 11: pb.NSKey
+	(*RPCSuccess)(nil),                     // 12: pb.RPCSuccess
+	(*RPCCountResponse)(nil),               // 13: pb.RPCCountResponse
 }
 var file_service_ns_key_proto_depIdxs = []int32{
-	9,  // 0: pb.FindEnabledNSKeyResponse.nsKey:type_name -> pb.NSKey
-	9,  // 1: pb.ListEnabledNSKeysResponse.nsKeys:type_name -> pb.NSKey
-	0,  // 2: pb.NSKeyService.createNSKey:input_type -> pb.CreateNSKeyRequest
-	2,  // 3: pb.NSKeyService.updateNSKey:input_type -> pb.UpdateNSKeyRequest
-	3,  // 4: pb.NSKeyService.deleteNSKey:input_type -> pb.DeleteNSKeyRequest
-	4,  // 5: pb.NSKeyService.findEnabledNSKey:input_type -> pb.FindEnabledNSKeyRequest
-	6,  // 6: pb.NSKeyService.countAllEnabledNSKeys:input_type -> pb.CountAllEnabledNSKeysRequest
-	7,  // 7: pb.NSKeyService.listEnabledNSKeys:input_type -> pb.ListEnabledNSKeysRequest
-	1,  // 8: pb.NSKeyService.createNSKey:output_type -> pb.CreateNSKeyResponse
-	10, // 9: pb.NSKeyService.updateNSKey:output_type -> pb.RPCSuccess
-	10, // 10: pb.NSKeyService.deleteNSKey:output_type -> pb.RPCSuccess
-	5,  // 11: pb.NSKeyService.findEnabledNSKey:output_type -> pb.FindEnabledNSKeyResponse
-	11, // 12: pb.NSKeyService.countAllEnabledNSKeys:output_type -> pb.RPCCountResponse
-	8,  // 13: pb.NSKeyService.listEnabledNSKeys:output_type -> pb.ListEnabledNSKeysResponse
-	8,  // [8:14] is the sub-list for method output_type
-	2,  // [2:8] is the sub-list for method input_type
-	2,  // [2:2] is the sub-list for extension type_name
-	2,  // [2:2] is the sub-list for extension extendee
-	0,  // [0:2] is the sub-list for field type_name
+	11, // 0: pb.FindEnabledNSKeyResponse.nsKey:type_name -> pb.NSKey
+	11, // 1: pb.ListEnabledNSKeysResponse.nsKeys:type_name -> pb.NSKey
+	11, // 2: pb.ListNSKeysAfterVersionResponse.nsKeys:type_name -> pb.NSKey
+	0,  // 3: pb.NSKeyService.createNSKey:input_type -> pb.CreateNSKeyRequest
+	2,  // 4: pb.NSKeyService.updateNSKey:input_type -> pb.UpdateNSKeyRequest
+	3,  // 5: pb.NSKeyService.deleteNSKey:input_type -> pb.DeleteNSKeyRequest
+	4,  // 6: pb.NSKeyService.findEnabledNSKey:input_type -> pb.FindEnabledNSKeyRequest
+	6,  // 7: pb.NSKeyService.countAllEnabledNSKeys:input_type -> pb.CountAllEnabledNSKeysRequest
+	7,  // 8: pb.NSKeyService.listEnabledNSKeys:input_type -> pb.ListEnabledNSKeysRequest
+	9,  // 9: pb.NSKeyService.listNSKeysAfterVersion:input_type -> pb.ListNSKeysAfterVersionRequest
+	1,  // 10: pb.NSKeyService.createNSKey:output_type -> pb.CreateNSKeyResponse
+	12, // 11: pb.NSKeyService.updateNSKey:output_type -> pb.RPCSuccess
+	12, // 12: pb.NSKeyService.deleteNSKey:output_type -> pb.RPCSuccess
+	5,  // 13: pb.NSKeyService.findEnabledNSKey:output_type -> pb.FindEnabledNSKeyResponse
+	13, // 14: pb.NSKeyService.countAllEnabledNSKeys:output_type -> pb.RPCCountResponse
+	8,  // 15: pb.NSKeyService.listEnabledNSKeys:output_type -> pb.ListEnabledNSKeysResponse
+	10, // 16: pb.NSKeyService.listNSKeysAfterVersion:output_type -> pb.ListNSKeysAfterVersionResponse
+	10, // [10:17] is the sub-list for method output_type
+	3,  // [3:10] is the sub-list for method input_type
+	3,  // [3:3] is the sub-list for extension type_name
+	3,  // [3:3] is the sub-list for extension extendee
+	0,  // [0:3] is the sub-list for field type_name
 }
 
 func init() { file_service_ns_key_proto_init() }
@@ -826,6 +950,30 @@ func file_service_ns_key_proto_init() {
 				return nil
 			}
 		}
+		file_service_ns_key_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListNSKeysAfterVersionRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_service_ns_key_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListNSKeysAfterVersionResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
@@ -833,7 +981,7 @@ func file_service_ns_key_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_service_ns_key_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   9,
+			NumMessages:   11,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
@@ -871,6 +1019,8 @@ type NSKeyServiceClient interface {
 	CountAllEnabledNSKeys(ctx context.Context, in *CountAllEnabledNSKeysRequest, opts ...grpc.CallOption) (*RPCCountResponse, error)
 	// 列出单页密钥
 	ListEnabledNSKeys(ctx context.Context, in *ListEnabledNSKeysRequest, opts ...grpc.CallOption) (*ListEnabledNSKeysResponse, error)
+	// 根据版本列出一组密钥
+	ListNSKeysAfterVersion(ctx context.Context, in *ListNSKeysAfterVersionRequest, opts ...grpc.CallOption) (*ListNSKeysAfterVersionResponse, error)
 }
 
 type nSKeyServiceClient struct {
@@ -935,6 +1085,15 @@ func (c *nSKeyServiceClient) ListEnabledNSKeys(ctx context.Context, in *ListEnab
 	return out, nil
 }
 
+func (c *nSKeyServiceClient) ListNSKeysAfterVersion(ctx context.Context, in *ListNSKeysAfterVersionRequest, opts ...grpc.CallOption) (*ListNSKeysAfterVersionResponse, error) {
+	out := new(ListNSKeysAfterVersionResponse)
+	err := c.cc.Invoke(ctx, "/pb.NSKeyService/listNSKeysAfterVersion", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // NSKeyServiceServer is the server API for NSKeyService service.
 type NSKeyServiceServer interface {
 	// 创建密钥
@@ -949,6 +1108,8 @@ type NSKeyServiceServer interface {
 	CountAllEnabledNSKeys(context.Context, *CountAllEnabledNSKeysRequest) (*RPCCountResponse, error)
 	// 列出单页密钥
 	ListEnabledNSKeys(context.Context, *ListEnabledNSKeysRequest) (*ListEnabledNSKeysResponse, error)
+	// 根据版本列出一组密钥
+	ListNSKeysAfterVersion(context.Context, *ListNSKeysAfterVersionRequest) (*ListNSKeysAfterVersionResponse, error)
 }
 
 // UnimplementedNSKeyServiceServer can be embedded to have forward compatible implementations.
@@ -973,6 +1134,9 @@ func (*UnimplementedNSKeyServiceServer) CountAllEnabledNSKeys(context.Context, *
 func (*UnimplementedNSKeyServiceServer) ListEnabledNSKeys(context.Context, *ListEnabledNSKeysRequest) (*ListEnabledNSKeysResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListEnabledNSKeys not implemented")
 }
+func (*UnimplementedNSKeyServiceServer) ListNSKeysAfterVersion(context.Context, *ListNSKeysAfterVersionRequest) (*ListNSKeysAfterVersionResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListNSKeysAfterVersion not implemented")
+}
 
 func RegisterNSKeyServiceServer(s *grpc.Server, srv NSKeyServiceServer) {
 	s.RegisterService(&_NSKeyService_serviceDesc, srv)
@@ -1086,6 +1250,24 @@ func _NSKeyService_ListEnabledNSKeys_Handler(srv interface{}, ctx context.Contex
 	return interceptor(ctx, in, info, handler)
 }
 
+func _NSKeyService_ListNSKeysAfterVersion_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListNSKeysAfterVersionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(NSKeyServiceServer).ListNSKeysAfterVersion(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/pb.NSKeyService/ListNSKeysAfterVersion",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(NSKeyServiceServer).ListNSKeysAfterVersion(ctx, req.(*ListNSKeysAfterVersionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 var _NSKeyService_serviceDesc = grpc.ServiceDesc{
 	ServiceName: "pb.NSKeyService",
 	HandlerType: (*NSKeyServiceServer)(nil),
@@ -1114,6 +1296,10 @@ var _NSKeyService_serviceDesc = grpc.ServiceDesc{
 			MethodName: "listEnabledNSKeys",
 			Handler:    _NSKeyService_ListEnabledNSKeys_Handler,
 		},
+		{
+			MethodName: "listNSKeysAfterVersion",
+			Handler:    _NSKeyService_ListNSKeysAfterVersion_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "service_ns_key.proto",
diff --git a/pkg/rpc/protos/models/model_ns_access_log.proto b/pkg/rpc/protos/models/model_ns_access_log.proto
index 027e4de..e7915da 100644
--- a/pkg/rpc/protos/models/model_ns_access_log.proto
+++ b/pkg/rpc/protos/models/model_ns_access_log.proto
@@ -20,4 +20,5 @@ message NSAccessLog {
 	int64 timestamp = 13;
 	string requestId = 14;
 	string timeLocal = 15;
+	string error = 16;
 }
\ No newline at end of file
diff --git a/pkg/rpc/protos/models/model_ns_domain.proto b/pkg/rpc/protos/models/model_ns_domain.proto
index 4bdad17..cb62d60 100644
--- a/pkg/rpc/protos/models/model_ns_domain.proto
+++ b/pkg/rpc/protos/models/model_ns_domain.proto
@@ -14,6 +14,7 @@ message NSDomain {
 	int64 createdAt = 4;
 	bool isDeleted = 5;
 	int64 version = 6;
+	bytes tsigJSON = 7;
 
 	NSCluster nsCluster = 30;
 	User user = 31;
diff --git a/pkg/rpc/protos/models/model_ns_key.proto b/pkg/rpc/protos/models/model_ns_key.proto
index a892183..1b7816e 100644
--- a/pkg/rpc/protos/models/model_ns_key.proto
+++ b/pkg/rpc/protos/models/model_ns_key.proto
@@ -3,12 +3,20 @@ option go_package = "./pb";
 
 package pb;
 
+import "models/model_ns_domain.proto";
+import "models/model_ns_zone.proto";
+
 // NS密钥
 message NSKey {
-	int64 id =1;
+	int64 id = 1;
 	bool isOn = 2;
 	string name = 3;
 	string algo = 4;
 	string secret = 5;
 	string secretType = 6;
+	bool isDeleted = 7;
+	int64 version = 8;
+
+	NSDomain nsDomain = 30;
+	NSZone nsZone = 31;
 }
\ No newline at end of file
diff --git a/pkg/rpc/protos/models/model_ns_zone.proto b/pkg/rpc/protos/models/model_ns_zone.proto
new file mode 100644
index 0000000..9ca8bc0
--- /dev/null
+++ b/pkg/rpc/protos/models/model_ns_zone.proto
@@ -0,0 +1,9 @@
+syntax = "proto3";
+option go_package = "./pb";
+
+package pb;
+
+// DNS子域
+message NSZone {
+	int64 id = 1;
+}
\ No newline at end of file
diff --git a/pkg/rpc/protos/service_ns_domain.proto b/pkg/rpc/protos/service_ns_domain.proto
index b6d4602..098caf9 100644
--- a/pkg/rpc/protos/service_ns_domain.proto
+++ b/pkg/rpc/protos/service_ns_domain.proto
@@ -28,6 +28,12 @@ service NSDomainService {
 
 	// 根据版本列出一组域名
 	rpc listNSDomainsAfterVersion (ListNSDomainsAfterVersionRequest) returns (ListNSDomainsAfterVersionResponse);
+
+	// 查找TSIG配置
+	rpc findEnabledNSDomainTSIG (FindEnabledNSDomainTSIGRequest) returns (FindEnabledNSDomainTSIGResponse);
+
+	// 修改TSIG配置
+	rpc updateNSDomainTSIG (UpdateNSDomainTSIGRequest) returns (RPCSuccess);
 }
 
 // 创建域名
@@ -92,4 +98,19 @@ message ListNSDomainsAfterVersionRequest {
 
 message ListNSDomainsAfterVersionResponse {
 	repeated NSDomain nsDomains = 1;
+}
+
+// 查找TSIG配置
+message FindEnabledNSDomainTSIGRequest {
+	int64 nsDomainId = 1;
+}
+
+message FindEnabledNSDomainTSIGResponse {
+	bytes tsigJSON = 1;
+}
+
+// 修改TSIG配置
+message UpdateNSDomainTSIGRequest {
+	int64 nsDomainId = 1;
+	bytes tsigJSON = 2;
 }
\ No newline at end of file
diff --git a/pkg/rpc/protos/service_ns_key.proto b/pkg/rpc/protos/service_ns_key.proto
index 75fe87c..96cb761 100644
--- a/pkg/rpc/protos/service_ns_key.proto
+++ b/pkg/rpc/protos/service_ns_key.proto
@@ -25,6 +25,9 @@ service NSKeyService {
 
 	// 列出单页密钥
 	rpc listEnabledNSKeys (ListEnabledNSKeysRequest) returns (ListEnabledNSKeysResponse);
+
+	// 根据版本列出一组密钥
+	rpc listNSKeysAfterVersion (ListNSKeysAfterVersionRequest) returns (ListNSKeysAfterVersionResponse);
 }
 
 // 创建密钥
@@ -81,4 +84,14 @@ message ListEnabledNSKeysRequest {
 
 message ListEnabledNSKeysResponse {
 	repeated NSKey nsKeys = 1;
+}
+
+// 根据版本列出一组密钥
+message ListNSKeysAfterVersionRequest {
+	int64 version = 1;
+	int64 size = 2;
+}
+
+message ListNSKeysAfterVersionResponse {
+	repeated NSKey nsKeys = 1;
 }
\ No newline at end of file