Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I've been reading about DNSSEC lately and had a question about DNS-Resolvers installed elsewhere on the internet.
If a client is using a DNS-Resolver that doesn't support DNSSEC will it fall back to using using non-secure DNS? Is this the norm now, or are most resolvers able to perform DNSSEC lookups?
If I sign up for DNSSec for my domain example.com, only Resolvers that support DNSSec will look for the signature.
Resolvers/Clients without support for DNSSec will not look for a signature. This is equivalent to "falling back" to not using DNSSec.
There are a few wrinkles with how DNSSec is implemented. Windows 7, for example, provides a "non-validating security aware stub resolver" which means that instead of maintaining trust on the Client, Windows 7 leaves it up to a DNS Server that supports DNSSec to validate the answer it gets to your DNS query. So, what if you are on Windows 7 but using a DNS server that does not support DNSSec?
You can test this behavior by changing your dns server in Windows settings and then visiting http://www.dnssec-failed.org/, which is a deliberately broken dnssec domain.
I tried it once with a non-dnssec server and again with Google DNS, which supports DNSSec. My non-dnssec server allowed me to get to the site while Google DNS prevented me from reaching the site. This proved to me that, as you put it, it will "fall back" to not using DNSSec.
