Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I tried dig +dnssec dig [domain name] +dnssec +short. Is RRSIG the only attribute to confirm if a name server has DNSSEC implemented or not? How do I identify a name server that has no DNSSEC implemented?
Also, what tools can I use to test vulnerability to DNS cache poisoning?
DNSSEC is per zone, a given nameserver can be authoritative on multiple names, one being DNSSEC enabled, one not being enabled. So depending on the zone you use, even if you ask to display DNSSEC records (because this is what +dnssec - an alias for +do the name of the flag in the DNS message - , the name is kind of misleading, it just force showing DNSSEC related records such as RRSIG which are normally not displayed; the flag to be used for DNSSEC is really more +cd which has the opposite meaning: its presence asks for NOT doing DNSSEC validation, and it is useful to troubleshoot DNSSEC related problems
Also just looking at signatures is not really enough. The question is not really "are signatures there" but more "is DNSSEC correctly setup", and for that you need to do the full DNSSEC validation, starting with the root and checking that all DS/DNSKEY/RRSIG computations match, so in short you need to use a (local) full validation resolver or an application such as delv or a troubleshooting tool online like DNSViz.
