4

I've read lots of different articles on what DNSSEC is and that it provides authentication for DNS. What I unfortunately haven't seen is a good description of the types of attacks and abuse that DNSSEC can prevent/mitigate.

With most of my own personal sites' DNS hosted by registrars, what compelling reasons should motivate me to spin up a VM for hosting my own BIND and DNSSEC?

1

Cache poisoning by implementing cryptographic signatures for zone transfers. If you wish to encrypt payloads then use IPSec

  • Can you explain more in detail what cache poisoning looks like and what it does in the case of DNS? – Naftuli Kay May 11 '15 at 17:11
  • 1
    When a device solicits a DNS server for a record (A, CNAME, TXT etc) it is asking for address translation from a name to a number (i.e. Google.com -> xxx.xxx.xxx.xxx) with which a subsequent connection can be made. In the event of a cache poisoning attack a rogue response is forced either into the arp table of the dns server or the client which then prompts them to visit the wrong device they were initially looking for. All of this is available to in the public domain so doing your due dilligence and researching the topic is recommended. – jas- May 11 '15 at 17:31
1

Even with your own nameserver, you'd be either recursively pulling dns entries from elsewhere or doing your very own mitm zones, which is why dnssec is there. On a related note, looking at the osi model, you could also depend fully on ssl certs on the browser to ensure you don't get redirected to a phishing site of some sort, as a kind of L7 guarantee of your endpoint. But as part of layered security, you'd want all supporting intermediate protocols to be self regulatory, hence all the *sec addons to the layers.

1

what compelling reasons should motivate me to spin up a VM for hosting my own BIND and DNSSEC

The security benefits, of course! If you are worried about attacks like DNS cache poisoning or man in the middle attacks (or just plain paranoid like me), then DNSSEC is for you. You can compare using DNSSEC for your DNS to using HTTPS for your web server. However, I will point out that you could ask you registrar to support DNSSEC without needing you to use your own nameservers (Although using your own nameservers until that is available is probably a good idea).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.