Domain Name System Security Extensions (DNSSEC) is a set of IETF specifications for digitally signed DNS.

learn more… | top users | synonyms

0
votes
0answers
13 views

DNSSEC implementation questions (BIND 9.10)

I am planning to sign multiple DNS zones with BIND and have the following questions which I could not answer by reading the latest BIND 9.10 Reference Manual. How can I use the same ZSK with ...
0
votes
2answers
29 views

Why do SSL enabled sites don't reply back according to “hosts” file record?

I was playing with the hosts file under my linux distro. Added an entry 192.168.3.121 www.facebook.com in the /etc/hosts file. Created 2 servers which link to an index.html file at ports 80 ...
0
votes
1answer
28 views

Questions regarding DNSSEC

Until now I understood the following about DNSSEC: A client requests a certain Domain let's say google.se The root server sends the client his public KSK and public ZSK signed by his private KSK so ...
0
votes
0answers
13 views

DNSSEC ZSK compromisation (man-in-the-middle attack)

Assuming I am administering a DNS zone and I operate an authoritative name server that is secured with DNSSEC (split ZSK/KSK setup). When the Zone-Signing-Key (ZSK) ever gets compromised, would it be ...
0
votes
1answer
70 views

What is the purpose of DNS-based Authentication of Named Entities (DANE) and how does it relate to DNSSEC?

What is the purpose of DNS-based Authentication of Named Entities (DANE)? And how does it relate to the Domain Name System Security Extensions (DNSSEC)? Secondly, how can I verify that DANE is ...
0
votes
1answer
26 views

Do I need to use DNScrypt, or can I just set up DNS by myself? What's the point?

So I'm not a fan of having lots of software on my PC, and I was thinking: do I actually need to use DNSCrypt or can I just type in DNS address of one of those private DNS services which do not log ...
9
votes
2answers
131 views

Why do browsers or operating systems not have default DNSSEC validation?

Many resolvers (including TLDs and Root TLDs) support DNSSEC, also Google's OpenDNS servers support it. Yet it isn't checked on the client side by default. Why is this?
0
votes
1answer
75 views

Is there a point to Dnscrypt when using VPN?

If a computer is already connected to the internet through VPN, is there point in encrypting DNS queries? From DNScrypt: DNSCrypt is a protocol that authenticates communications between a DNS ...
3
votes
1answer
52 views

Opt into strict DNSSEC checking - does DNSSEC provide a way for a zone to request strict signature validation?

Is there a way for a domain good.com to promise that it will sign all of its DNS records, and that any unsigned records for any host *.good.com should be rejected? In other words, is there a way for ...
0
votes
1answer
29 views

Setting up DNSsec for an exotic TLD

I have a .money domain name and I would like to implement DNSSEC. My registrar is GoDaddy and their DNSSEC management system does not support .money. How can I easily setup DNSSEC for my domain?
2
votes
1answer
86 views

DNSCrypt-proxy: This certificate looks valid

I have just installed dnscrypt-proxy and dnsmasq with DNSSEC but I get a strange message in the logfile from dnscrypt-proxy. [INFO] + DNS Security Extensions are supported [INFO] - [dnscrypt.eu-dk] ...
3
votes
1answer
48 views

How to acquire DNSSEC root trust anchor from IANA?

I want to establish trust in a DNSSEC record. I found, that it can be done $ dig +sigchase +trusted-key=./root.key @8.8.8.8 eesti.ee root.key could be obtained with $ dig . DNSKEY @8.8.8.8 | grep -...
1
vote
1answer
73 views

Can you force your PC or device to use only DNSSec-verified lookup results?

Okay, I'll admit something first-off: I don't really understand some of the practical aspects of how DNSSec protections work very well.(Even after reading resources like this.) Well, I certainly ...
4
votes
1answer
126 views

Is DNSSEC really useless if TLS is properly configured?

I was reading this article http://sockpuppet.org/blog/2015/01/15/against-dnssec/ and this line caught my eye, "With TLS properly configured, DNSSEC adds nothing." My gut reaction was to disagree, but ...
2
votes
1answer
113 views

How does DNSSEC work? [closed]

How does my OS or browser knows to check for DNSSEC? How does the verification process works? Do I need a key from Comodo/Verisign? Do I need to install something to my hosting? What happens in men in ...
3
votes
2answers
71 views

Is running a DNSSEC enabled DNS service as hard as running a CA?

I think we all know that running a CA is really hard to get right. Now there's a "new" system that uses digital signatures to associate data with names: DNSSEC. DNSSEC signs the DNS records and ...
5
votes
1answer
86 views

Does DNSSEC still have the “enumerate all names in zone” problem?

According to Wikipedia: DNSSEC introduces the ability for a hostile party to enumerate all the names in a zone by following the NSEC chain. NSEC RRs assert which names do not exist in a zone ...
7
votes
1answer
76 views

Non-validating DNSSEC aware client security implications

I understood that Windows 7 and newer Windows clients are DNSSEC aware, but that they are non-validating. That means that they are not performing any DNSSEC validation, but that they can require the ...
1
vote
1answer
155 views

What if a resolver doesn't support DNSSEC?

I've been reading about DNSSEC lately and had a question about DNS-Resolvers installed elsewhere on the internet. If a client is using a DNS-Resolver that doesn't support DNSSEC will it fall back to ...
1
vote
0answers
228 views

Vulnerability NTP:Traffic amplification in clrtrap feature of ntpd affect or not affect to Cisco device?

I am using CCSVM tool SCAN for Network devices (Cisco). Below you can find the scan result: Title vulnerability: NTP: Traffic amplification in clrtrap feature of ntpd Solution fix: Disable NTP ...
1
vote
0answers
31 views

Why do DNSKEY have a RRSIG for themselves?

Looking at all examlpes of DNSSEC, you see that the zone includes not only the DNSKEY , but also a RRSIG of the DNSKEY created with that same DNSKEY? Why is this? Why publish a self-signed RRSIG? What ...
2
votes
1answer
77 views

DNSSEC: Why are RRSIGs returned in the “Answer” not “Additional” section?

Looking at Wireshark traces of DNSSEC responses, I see that the RRSIG is returned in the "Answer" section, even though it wasn't part of the query. Why isn't it returned in the "Additional" Section, ...
2
votes
2answers
355 views

What types of attacks and abuse does DNSSEC protect against?

I've read lots of different articles on what DNSSEC is and that it provides authentication for DNS. What I unfortunately haven't seen is a good description of the types of attacks and abuse that ...
10
votes
1answer
168 views

Why can't we bypass DNSSEC

DNSSEC is a suite of security extensions to enhance DNS security. (e.g.: avoid cache poisoning) However I was wondering how does the resolver know that the next NS will use DNSSEC? E.g.: Someone ...
2
votes
1answer
131 views

Does any DNS Recursive resolver accept a “DNSSEC-only” option under DNSCurve?

I want to use DNSCurve (for privacy) to a trusted DNSSec resolver (for integrity), and want to ensure that I can tell a recursive resolver (like 8.8.8.8, or OpenDNS) that I only want DNSSec queries. ...
3
votes
3answers
136 views

Does using DNSSEC in parallel with an anonymisation network decrease your privacy?

When using an anonymous communication network like Tor, to ensure privacy you must route your DNS traffic through the system even if your computer always uses DNSSEC for DNS lookups, would this be ...
5
votes
1answer
139 views

Is there an HSTS equivalent for DNSSec?

Is there any way to set a DNSSec-always policy similar to how HSTS commands Web Browsers to always use HTTPS? This would mitigate a DNSSec-strip attack (similar to SSLStrip) I'm also unclear if this ...
4
votes
1answer
88 views

I just deployed DNSSec. Is there any benefit in DANE for a CA- issued Cert?

I just deployed DNSSec at https://val-id.com and https://getvalid.com Since DNSSec is a requirement of DANE, and I have a CA-based certificate, can I show my support for DANE-based deployments by ...
2
votes
0answers
51 views

In DNSSec, are Delegation Signer Records always SHA-1?

I'm creating a RSA/SHA-512 Zone Signing Key and Key Signing Key at Dynect Managed DNS (corporate offering) The Delegation Signer Record that was created is SHA1. Should I be concerned about this?
4
votes
1answer
173 views

When using https but not DNSSEC, under what situation, a client is vulnerable?

So DNSSEC is to ensure that returned IP address is not poisoned. And https is to verify the remote server. My question is that when protected by https, under what circumstances, a client is ...
7
votes
1answer
233 views

How to get started with DNSSEC?

I have been assigned the task of improving security of a specific service. After some analysis of the requirements we have come to the conclusion, that a certain aspect of the specified requirements ...
2
votes
1answer
263 views

DNSSEC: Does the algorithm of the ZSK need to match the algorithm of the KSK?

I am in the process of setting up DNSSEC for my domains. Initially I was going to go with algorithm 13 (ECDSA-P256-SHA256), but it seems that dyn.com doesn't allow me to add a DS record with an ...
2
votes
2answers
421 views

DNSSec vs SSL and IPsec

Theoretically, DNS cache poisoning shouldn't matter,because everything important is protected by SSL and IPsec. So why DNSSec was developed? Aren't the first two protocols sufficient?
1
vote
2answers
95 views

Security of certificate when using DNSSEC

When setting up secure server, it is suggested not to use self-signed certs and instead to be signed by a CA. Of course, post-Snowden we now know that there may be problems with CA's that could allow ...
7
votes
2answers
959 views

Storing SSL certificates in DNS records

Why not get rid of all certificate authorities and all the special kind of SSL certificates there are (extended validation etc. etc.) and instead just require anyone who wanted SSL to write their own ...
9
votes
2answers
2k views

Is the Google address being spoofed on my computer?

I might use some inappropriate terminology because I am no expert, but please feel free to correct me where it is needed. I believe that a process has modified some network file on my computer, like ...
5
votes
0answers
91 views

What's stopping DANE? [closed]

As I understand it, DANE (RFC 6698) is a promising candidate for addressing issues with current TLS Trust Anchors (i.e. Trust Anchors). My attempt at explaining the issue: Currently, CAs are ...
2
votes
1answer
116 views

Why is it dangerous for attackers to be able to enumerate all subdomains of a given domain?

While it seems like a bad idea for attackers to be able to use DNSSEC to enumerate subdomains, I cannot think of a specific attack that this information enables, which would not be doable without this ...
3
votes
1answer
125 views

Email, Certificates and DANE [closed]

Does DANE offer the ability to provide certificates for services? Or is it just hosts? How does one specify a mail server with DANE? If my email is jd@foo.com but mail.bar.com is the email server, ...
2
votes
1answer
82 views

Does DNSSEC provide signed statements that a certain domain does NOT yet support DNSSEC? If not, why not?

In my security class with David Wagner, we talked about some of the reasons why DNSSEC is not widely adopted right now. One of the reasons was that for backward compatibility reasons, clients need to ...
4
votes
1answer
631 views

Is DNSSEC immune to stripping signatures?

In my opinion, it should be possible to forge DNS reply so it doesn't include DS/RRSIG/... parts for any request, thus bypassing DNSSEC validation of resolved domain. Is DNSSEC system immune to this ...
10
votes
1answer
591 views

DNSSEC signing algorithms

Virtualmin supports a flurry of algorithms for DNSSEC: RSASHA1, RSASHA256, RSAMD5, DSA, DH, HMAC-MD5, NSEC3RSASHA1, NSEC3DSA. If I understand correctly, there's Proof of Concept available for SHA1 ...
4
votes
3answers
396 views

Why does DNSSEC have a ridiculous keysigning ceremony?

Every three months, 7 people fly to a secure ICANN server building and go through an elaborate ceremony to generate a new signing key for DNSSEC. The entire affair appears to be based on politics and ...
3
votes
1answer
588 views

How does a client know that a DNS zone is DNSSEC protected?

Recently, I've been reading about DNSSEC and how it works. I found other questions and some very interesting answers on this and other websites related to this matter. However, I have a question to ...
22
votes
2answers
4k views

If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?

Looking at all the people who question the viability of DNSSEC, it's no wonder that the adoption rates are so poor. However, what about DNSCurve? It supposedly fixes all the DNS security and privacy ...
10
votes
3answers
607 views

Why is RFC4255 (SSHFP) not used for https?

I had this idea a few hours ago, but of course it already exists and there is even an RFC... Why don't we publish the fingerprint for the SSL/TLS certificate via DNS? We need DNSSEC to make sure the ...
2
votes
1answer
2k views

How to verify DNSKEY by using its corresponding DS

A DNSKEY on a name server can be verified by using it DS stored on its parental name server. According to RFC4034: The DS record refers to a DNSKEY RR by including a digest of that DNSKEY RR. The ...
19
votes
2answers
2k views

If DNSSEC is so useful, why is its deployment non-existent for top domains?

I've read several papers on DNSSEC, and it appears that it does prevent many attack classes, and the only two possible downsides is that its deployment is hard (DNSSEC is complex), and that you can ...
5
votes
1answer
2k views

How to test the validity of DNSSEC from a command line interface?

I am doing a research project on The Domain Name System Security Extensions (DNSSEC). I have a SOA, Stub resolver and a client as well as a attack machine. My question is this. Is there a way to ...
4
votes
1answer
502 views

Can NSEC domain enumeration happen for zones with wildcard records?

In DNSSEC, NSEC records are used to provide proof of nonexistence. The trouble is that these records provide pointers to existent domain names (the closest known domain in either direction) ...