3

I want to use DNSCurve (for privacy) to a trusted DNSSec resolver (for integrity), and want to ensure that I can tell a recursive resolver (like 8.8.8.8, or OpenDNS) that I only want DNSSec queries.

Logically this would be similar to issuing either of the following options:

  • Recurse
  • No Recurse

Question

Does such a technique exist, no matter if it is enforced by a DNS recursive resolver (mentioned above) or as a proposed RFC enhancement to the passive DNS client to Server protocol?

|improve this question
  • Is DNSCurve a requirement for an acceptable solution for you? – schroeder♦ Apr 10 '15 at 4:55
  • @schroeder I'm writing an app for iOS and Android that requests resolution of a DNS name. I assume that no such extension exists, or for idealistic reasons, it doesn't exist either. I want to have a guarantee to my app that the DNS host is really the DNS host that is expected ... (using a local resolver, or an imported Java or iOS resolver) – goodguys_activate Apr 12 '15 at 2:27
2

It appears that secure DNSSec recursive queries are not possible to enforce.

According to the notes in this IETF draft:

DNSSEC is not an enforcement mechanism, it's a resource. When I see folks voice opinions that DNSSEC's recommended operation has to strictly followed, my gut reaction is that these folks have forgotten the purpose of all of our efforts. ~ Ed Lewis

DNSSEC is offered as a help and DNS servers can be configured to maintain the security of the recursion chain, or not. It also appears form Mr Lewis' comment, that there might not be a method to enforce secure recursion for some time.

|improve this answer
  • I just read that note... somewhat abstract points he is saying. He does seem to say that a "local policy" is what trumps a global policy... specifically on the Caching Server. If a caching server is in my "local policy" realm of influence, I don't see why I can't have a local policy that says "ensure that this DNS label is not spoofed via DNSSEC". Since he works for Ultra, and I'm a UltraDNS customer, I'll open a support ticket.... – goodguys_activate Apr 10 '15 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.