It doesn't happen often that a root name server changes, but when it does sometimes it takes months for OS vendors to provide patches and in the mean time there is a security risk.


How to get named.cache (or named.root/db.cache from the same directory - the files are identical) in a secure way from http://www.internic.net/zones/ or ftp://ftp.internic.net/domain/ or http://www.internic.net/domain/?

The server behind those URLs does not support https. But there are md5 and sig files in these directories for every data file available.

As md5 isn't that secure, could the sig files be used?

If so, how?

(Note I'm not asking this on unix.stackexchange.com or superuser.com as I'm interested in the security aspect of this in a platform neutral way).

  • These md5's are there for to checksum conparison.
    – AKS
    Commented May 31, 2015 at 14:41

2 Answers 2


The .sig file provided for each zone allows for an method of verification using the signature located at the bottom of the INTERNIC_ROOT_ZONE.signatures.asc file.

Using PGP you can then do the following for verification (see PGP key here):

$ gpg --keyserver --recv-key 0x0BD07395
$ gpg --verify zone.sig zone
  • So how do I know internic.net/zones/INTERNIC_ROOT_ZONE.signatures.asc is secure? Commented May 31, 2015 at 14:56
  • With 100% certainty; you don't nor will you ever unless you are the one holding the private key used to derive the public key embedded within that file. So essentially there is a level of trust that the individual that is signing those packages is doing their due diligence in protecting the private keys associated with the signatures of the packages listed. Seeing as how these are indeed root level DNS servers there is a level of security that is employed that should allow you trust it.
    – jas-
    Commented May 31, 2015 at 15:00
  • 1
    To be honest I am not certain where their public key is for verification. You may have to contact them for it. Usually that is public domain but I couldn't find it in their site.
    – jas-
    Commented May 31, 2015 at 15:46
  • 1
    Found it (yes, I know about youtube.com/watch?v=ibF36Yyeehw): gpg --keyserver keys.gnupg.net --recv-key 0BD07395 which means I trust keys.gnupg.net, the way gpg communicates with keys.gnupg.net and the way Internic has communicated their public key to keys.gnupg.net. Commented May 31, 2015 at 16:05
  • 1
    Note I needed this one: pgp.mit.edu:11371/pks/lookup?op=get&search=0x0BD07395 Commented May 31, 2015 at 18:58

Without SSL an attacker can potentially modify the data files and the md5 signature files to match. So they provide little security. Md5 checksums should be provided over SSL to secure them tho this isn't frequently done. The sig files don't need SSL to be secure provided that you securely get the public key.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .