Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am doing a research project on DNSSec.

I have a SOA, Stub resolver and a client as well as a attack machine.

My question is this. On a Linux Client is there a way test for validity of record after after a DNS poisoning attack. This check needs to be done at the command line.

I have verified that the DNSSec records are being forwarded on.

share|improve this question

According to

Obtain root keys. You can do this with dig on an unpoisoned machine:

dig . DNSKEY | grep -Ev '^($|;)' > root.keys

Verify your target dns record:

dig +sigchase +trusted-key=./root.keys A | cat -n

The other alternative is to set up a validating DNS resolver like unbound. I use it to provide DNSSEC security on desktop machines. It's easily available in Fedora 17. Or BIND in Debian 7.0. I forget whether there are debian packages which set up unbound for you, but it's not hard to do manually either.

Then run dig against your secure resolver, and it will show a flat error (SERVFAIL, I think) if there are invalid results. You can also configure unbound to log details about each validation failure.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.