DNSSec (comcast) vs DNSCurve (OpenDNS)

Question

I was previously using OpenDNS on my internal network. I found out today that comcast has switched over to DNSSec:Comcast DNSSec.

I've did a little research on DNSSec and its benefits. I understand the basics of DNSSec. Pretty much DNSSec signs your dns request so you won't have man-in the middle situation happen to your dns queries. Does a lot of malware use dns man-in-the middle attacks?

So then i found out OpenDNS doesn't think DNSSec is the ideal solution: OpenDNS opinion on DNSSec. They use something i've never heard before called DNSCurve. Sounds pretty similar to DNSSec. With comcast's solution you seem to be automatically protected if you use their DNS Servers. Not sure if this is true with OpenDNS or not. They also have a cool tool which i would love to use: DNSCrypt which encrypts your dns requests unfortunately right now its only for MACS.

So the overall question i should make the switch or is OpenDNS with its technology just as secure as DNSSec on comcast

Answer 1

DNSSEC and DNSCurve address completely different aspects of DNS security.

First of all, DNSSEC does NOT sign your queries. Rather DNSSEC allows a zone (such as a domain) to be signed by its owner, and allows a resolver (for instance, Comcast's DNS servers) to verify the signature, and therefore be sure that the zone data it gets is authentic. It protects the resolver from receiving bad data, but does nothing to prevent MITM or snooping between you and the resolver.

DNSCurve on the other hand encrypts communications between recursive resolvers and authoritative servers and allows authoritative servers to sign their data against forgery, but does nothing to protect an end-user client from a bad recursive resolver. OpenDNS's DNSCrypt solution is based on the same technology as DNSCurve, but protects the last-mile between a trusted 3rd party recursive resolver like OpenDNS and the end-client.

As for which is more secure, neither is. They are both secure, however the security is applied in different areas. In either case you are picking which aspect of DNS security is more important, rather than which security tool is stronger.

As for what you should do, that is something only you can decide, but do please consider the following:

1: you could use comcast's DNSSEC resolvers, and hope no one snoops and MITMs the connection between your machines and comcast's resolvers.

2: you could use OpenDNS's resolvers, and connect to them using DNSCurve, and hope that no one feeds bad data to those resolvers, as they do not use DNSSEC. (To be fair, OpenDNS has a very good track record of preventing such attacks.)

3: you could run your own resolver, using freely available open source software such as BIND, PowerDNS, or Unbound - enable DNSSEC on said resolver, and keep the queries on your local network - or better yet, run a resolver on each machine. (This is the best option IMHO, as it addresses the weaknesses of both of the other two options)