Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

I am using a web browser to access DNSSec enabled sites. My current name server doesn't (won't) support DNSSec for at least a year. What are my alternatives?

Do any ISPs currently offer DNSSec? Any other viable secure companies?

share|improve this question
1  
For querying on your end or for providing responses to people looking up your domain? – Jeff Ferland♦ Oct 4 '11 at 17:17
@JeffFerland This is for querying on my end. – makerofthings7 Oct 4 '11 at 17:34

1 Answer

up vote 2 down vote accepted

You may have to clarify what it is you mean when you say that your current nameserver doesn't support DNSSEC when you're speaking from the resolver perspective. You see, any nameserver (that will do recursive queries for you) will cache and forward any record set your request. That includes RRSIG records which are the foundation of DNSSEC.

Examples:

http://www.digwebinterface.com/?hostnames=www.isoc.org&type=ANY&ns=all

http://www.digwebinterface.com/?hostnames=www.isoc.org&type=RRSIG&ns=all

You can run a DNS resolver on your own machine that rejects invalid DNSSEC records. It is the local resolver's job by default, however. No special configuration is needed for nameservers to support this.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.