Domain Name System Security Extensions (DNSSEC) is a set of IETF specifications for digitally signed DNS.

learn more… | top users | synonyms

3
votes
1answer
49 views

Opt into strict DNSSEC checking - does DNSSEC provide a way for a zone to request strict signature validation?

Is there a way for a domain good.com to promise that it will sign all of its DNS records, and that any unsigned records for any host *.good.com should be rejected? In other words, is there a way for ...
2
votes
1answer
77 views

Does DNSSEC provide signed statements that a certain domain does NOT yet support DNSSEC? If not, why not?

In my security class with David Wagner, we talked about some of the reasons why DNSSEC is not widely adopted right now. One of the reasons was that for backward compatibility reasons, clients need to ...
1
vote
1answer
247 views

DNSSEC: Does the algorithm of the ZSK need to match the algorithm of the KSK?

I am in the process of setting up DNSSEC for my domains. Initially I was going to go with algorithm 13 (ECDSA-P256-SHA256), but it seems that dyn.com doesn't allow me to add a DS record with an ...
2
votes
0answers
49 views

In DNSSec, are Delegation Signer Records always SHA-1?

I'm creating a RSA/SHA-512 Zone Signing Key and Key Signing Key at Dynect Managed DNS (corporate offering) The Delegation Signer Record that was created is SHA1. Should I be concerned about this?
1
vote
0answers
214 views

Vulnerability NTP:Traffic amplification in clrtrap feature of ntpd affect or not affect to Cisco device?

I am using CCSVM tool SCAN for Network devices (Cisco). Below you can find the scan result: Title vulnerability: NTP: Traffic amplification in clrtrap feature of ntpd Solution fix: Disable NTP ...
1
vote
0answers
31 views

Why do DNSKEY have a RRSIG for themselves?

Looking at all examlpes of DNSSEC, you see that the zone includes not only the DNSKEY , but also a RRSIG of the DNSKEY created with that same DNSKEY? Why is this? Why publish a self-signed RRSIG? What ...
0
votes
0answers
7 views

DNSSEC ZSK compromisation (man-in-the-middle attack)

Assuming I am administering a DNS zone and I operate an authoritative name server that is secured with DNSSEC (split ZSK/KSK setup). When the Zone-Signing-Key (ZSK) ever gets compromised, would it be ...
-1
votes
0answers
8 views

How does DNS-based Authentication of Named Entities (DANE) work?

How does DNS-based Authentication of Named Entities (DANE) work? If I'm correct it depends on a valid DNSSEC configuration (Domain Name System Security Extensions)? But what does it do and how does it ...