**Domain Name System Security Extensions (DNSSEC)** is a set of IETF specifications for digitally signed DNS.

learn more… | top users | synonyms

2
votes
0answers
48 views

Is there an HSTS equivalent for DNSSec?

Is there any way to set a DNSSec-always policy similar to how HSTS commands Web Browsers to always use HTTPS? This would mitigate a DNSSec-strip attack (similar to SSLStrip) I'm also unclear if this ...
2
votes
0answers
23 views

In DNSSec, are Delegation Signer Records always SHA-1?

I'm creating a RSA/SHA-512 Zone Signing Key and Key Signing Key at Dynect Managed DNS (corporate offering) The Delegation Signer Record that was created is SHA1. Should I be concerned about this?
1
vote
0answers
66 views

DNSSEC: Does the algorithm of the ZSK need to match the algorithm of the KSK?

I am in the process of setting up DNSSEC for my domains. Initially I was going to go with algorithm 13 (ECDSA-P256-SHA256), but it seems that dyn.com doesn't allow me to add a DS record with an ...
1
vote
0answers
56 views

Does DNSSEC provide signed statements that a certain domain does NOT yet support DNSSEC? If not, why not?

In my security class with David Wagner, we talked about some of the reasons why DNSSEC is not widely adopted right now. One of the reasons was that for backward compatibility reasons, clients need to ...
0
votes
0answers
14 views

Shouldn't DNSCurve be parallel to DNSSEC at root level for diversity?

As per the answer at If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?, it's been determined that one of the reasons that DNSCurve is behind DNSSEC is due to the nature of the ...
0
votes
0answers
14 views

What jurisdiction do DNS root servers and corresponding TLDs have?

We are setting up DNSSec and want to document risks that relate to the core root servers, their binding keys, and the next level DNS TLD. Since there is history saying that the US Government owns ...
0
votes
0answers
32 views

Root Zone Trust Anchor Publication?

I'm reading through DNSSEC Trust Anchor Publication for the Root Zone. Section 4 lists two methods to distribute the root keys: HTTP and HTTPS. Fetching over HTTP is not secure, and fetching over ...