Questions tagged [dnssec]

Domain Name System Security Extensions (DNSSEC) is a set of IETF specifications for digitally signed DNS.

Filter by
Sorted by
Tagged with
0
votes
0answers
20 views

How to validate DNSSEC signatures - zone cuts?

RFC 4035, section 5.3.1 lays out the rules for validating DNSSEC RRSIG records: The RRSIG RR and the RRset MUST have the same owner name and the same class. The RRSIG RR's Signer's Name field MUST be ...
0
votes
0answers
42 views

Tooling and serialization format for DNSSEC signture chain

I'm looking for a compact, canonical (and possibly but not necessarily human-readable) format for serializing the signature chain for a RRset (or proof that it lies under an insecure delegation) for ...
1
vote
0answers
25 views

Supplying registrar with dnssec related records

I have a domain name under .money, which supports DNSSEC. However, my registrar hasn't done DNSSEC with this TLD before and is asking me to supply the Key Tag, Algorithm Type, Digest Type and Digest --...
0
votes
1answer
43 views

What happens if I change RR on my domain's DNS after DNSSEC has already been enabled?

DNSSEC security starts by first grouping DNS records (RR) of the same type into a record set (RRset) and then this RRset gets signed... Does this mean that I have to completely define all the RR in my ...
-1
votes
1answer
55 views

Can I simplify DNSSEC implementation in a context of public content?

Contents of government gazette, Linux distributions, Open Data, etc. are public, there are no constraints for "increase user privacy". On the contrary, we want to guarantee transparency... ...
1
vote
2answers
257 views

Does Cloudflare's DNS over TLS (DoT) implement DNSSEC too?

I will shoot the question straight: I am confused about if I decided to implement DNS over TLS (DoT), would I lose DNSSEC? Little bit of details: I am connected with IPv4 + IPv6 Cloudflare DNS ...
1
vote
0answers
110 views

Detecting a web based MITM attack?

I've been looking into ways to detect a Man In the Middle attack, when the client has "duped" into trusting third party CA. Examples of this are, anti-virus applications and corporate ...
0
votes
0answers
65 views

Is there any reason not to enable DNSSEC? [duplicate]

Google Domains' DNS management has a link that says Enable DNSSEC. And, as I understand it, this prevents spoofing of DNS responses. And, that sounds great! So, why wouldn't I want to enable DNSSEC? ...
1
vote
0answers
42 views

How do you mitigate the risk of stolen unencrypted data because you are using Cloud DNS to proxy the request that are sent to your server?

Goal My goal is to build a PWA. I am new to programming and I believe it is better to start with NGINX. I have not found a good article (explaining the security risk) about using the Cloud DNS (such ...
1
vote
1answer
76 views

What portion of recursive (ISP, public, etc.) nameservers validate DNSSEC strictly?

I'm adopting/setting up DNSSEC on my domains for the first time, and curious about the practical benefits I can expect. In theory, regardless of whether client/stub resolvers want checking, recursive ...
2
votes
1answer
69 views

Certificate warning when I enable DNSSEC

I registered mydomain.net (with Google domain registration server). In the DNS settings on the google control panel, I say that mail.mydomain.net should go to the email cloud app (business.zoho.com in ...
0
votes
1answer
531 views

Is it possible to create DNSSEC chain of trust for local root zone

I have local (private) root domain domainX.example and subdomains : subdomainY.domainX.example and subdomainZ.domainX.example. How would I create chain of trust without using root-servers.net?
0
votes
2answers
135 views

Would DNSSEC and certificates for IP addresses be enough?

Using DNSSEC you can be sure that you have the right IP for a domain and using a certificate for the IP signed by someone you trust you know you have the right IP. Shouldn't this be enough to know ...
3
votes
1answer
561 views

A third party Web site wants me to validate my domain ownership using a TXT record

What are the security risks with adding TXT records for third party tools? Can they get any information back from your servers with adding that record for them? The example below is from the "have i ...
1
vote
1answer
791 views

Subdomain Scan protection

I have seen that all our subdomains can be eaisly be scanned with help of websites like dnsdumpster. What is the best way to protect subdomains of any website from getting scanned or revealed via ...
1
vote
1answer
70 views

How can I ensure consistent privacy policy of my DNS server to that of the TLD's privacy policy?

Whenever I query example.com, one of the TLD root servers for .com will be queried for example.com. This query includes my IP address, and in theory could be used to identify my browser session. ...
1
vote
0answers
116 views

Non-TLS-authoritative ZSKs?

Under DANE, the digital chain of trust goes (roughly): [Public visibility of the ceremony for the generation of the] ICANN Root Zone Key, which something something involving the TLD authorities and ...
0
votes
1answer
269 views

Encapsulating DNSSec into Dot or DoH

I read a few articles on how DNSSec works (here and here). The DNSSec request are not encrypted, and I wanted to know if it's possible to encapsulate it into a DoH or a DoT request?
2
votes
1answer
715 views

Is it critical to enable DNSSEC if I am using TLS/SSL certificate on a website? [duplicate]

I have TLS installed for a website, does it matter if DNSSEC is enabled for this domain or there is no real need for that then?
0
votes
1answer
232 views

Unexplained DNS connections on boot

I was on an Ubuntu VPS today, with a bind9 DNS server (without DNSSEC configured) installed and running. Immediately after booting the machine I ran: netstat -tanp And received this output: Proto ...
1
vote
0answers
77 views

How does DNSCurve protect against forgery in a man-in-the-middle attack scenario?

This Question is about DNSCurve. I thought of DNSCurve as "HTTPS for DNS" (like in this Answer) but had some resent thoughts about the trust-relationship between resolvers and nameservers serving the ...
1
vote
1answer
188 views

DNSSEC - does the domain owner owns a key?

The purpose of DNSSEC is to prevent some attacks like cache poisoning so a client can be sure that the answer it gets from a recursive DNS server are correct (the IP is the correct IP). The root DNS ...
5
votes
2answers
678 views

Do you need DNSSEC if you use HSTS? [duplicate]

I'm trying to understand the benefits of DNSSEC. If a user goes to my site example.com and the DNS cache was poisoned redirecting the user to the bad guy's IP, what would happen? I've enabled HSTS. ...
0
votes
1answer
308 views

Is there any advantage to using encrypted DNS on a VPN server

I have a personal OpenVPN server. I am worried that the fact the DNS resolution coming out of the server isn't encrypted, since I am the only one that uses the server at the moment, attribution isn't ...
2
votes
2answers
11k views

Connecting to my VPN via IP or domain name?

Background: So I use a private VPS to host my own VPN, rather than pay/trust another company to host it for me. I am an intermittent traveller so it is cheaper for me to spin up or down my server as ...
5
votes
1answer
406 views

How DNS hijacking was myetherwallet.com fault even though AWS DNS server was hijacked yesterday

I have been reading on how myetherwallet was hacked a day ago because Amazons domain service was compromised, as mentioned here, https://www.reddit.com/r/ethereum/comments/8ek86t/...
8
votes
1answer
689 views

How to obtain privacy and authenticity with DNS?

I use pfSense (Unbound) as my local resolver. Historically I've pointed it at root recursive resolution, because I perceived my main threat as trustworthiness and recency of data (poisoned/invalid DNS)...
3
votes
2answers
1k views

Is it okay to publish a TLSA records for non-DNSSEC CNAME'ed services?

In the scenario with two domain names example.com secured with DNSSEC example.org not secured with DNSSEC and a mail service running at smtp.example.org: I want to secure the mail service using ...
2
votes
1answer
502 views

How many times does a DNS server need to sign?

I have a question about DNSSEC and how many times a DNS server must sign or in other words, how many signatures are there in a day. I know that DNSSEC builds on a chain of trust starting at the root ...
1
vote
1answer
736 views

Can I use BIND in place of DNSCrypt? [closed]

I was using DNSCrypt on my personal computer (linux). I uninstalled it, and now I'm getting errors reinstalling. I believe development on DNSCrypt was being abandoned anyway, because Cisco/OpenDNS ...
4
votes
1answer
615 views

Is my ISP hosting malware or has it suffered a sub-domain takeover, or is my router compromised?

I'm new to this netsec stuff but I wanted to ask an opinion about what is going on here. I've been doing some web development and have been using Codekit for ages, but recently noticed that it's in-...
2
votes
1answer
483 views

Value of DNSSEC with allow-downgrade option

Does setting up DNSSEC in client (systemd-resolved) with allow-downgrade option have any value? Does it improve security at all?
2
votes
2answers
199 views

DNS Poisoning - How to edit the “list” it in the target server?

I know how to redirect some DNS name to another DNS name. For example, access security.stackexchange.com and redirect to facebook.com. But I am doing this with my own server and the connected ...
2
votes
3answers
614 views

Effects of CVE-2017-9445?

http://thehackernews.com/2017/06/linux-buffer-overflow-code.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9445 "that could allow remote attackers to potentially trigger a buffer ...
3
votes
1answer
1k views

Can someone explain me the DNSSEC NSEC3 output?

I'm trying to understand how NSEC and NSEC3 records work in DNSSEC. When I query for an non-existent domain with supports NSEC3, I get the following output $ dig +dnssec NSEC3 gggg.icann.org. | grep -...
0
votes
1answer
310 views

Is HPKP a alternative to DNSSEC? [duplicate]

Using the Public Key Pinning header the user will only trust in my SSL Certificate, supposedly. If I use only the HPKP and the certificate is safe, the attacker not got it, still possible the ...
3
votes
1answer
687 views

What is a secure DNSKEY bit length and usage time?

During penetration testing I have seen DNSSEC keys with lengths of 1024 and 512 bits. NIST recommends a key length of at least 2048 bits. So is it correct to assume that these DNSKEY's are unsafe to ...
1
vote
2answers
194 views

What are the implications of using an “unsafe” DNSSEC algorithm like RSA/MD5?

Why is it unsafe to use the DNSSEC algorithm RSA/MD5? In practical terms, how is DNSSEC weakened by the use of an algorithm such as MD5, which has a known weakness of collisions? RFC 6944 states, ...
1
vote
1answer
260 views

What is the effect on a domain when the secondary name server is compromised?

I've heard of a case wherein the domain name of the secondary name server was expired and free to register. Let's say example.com has two registered nameservers: example-ns1.com (primary) example-...
0
votes
1answer
204 views

Is it possible to prevent SSL stripping attack via DNSSEC or IPSEC?

I am pondering about SSL Stripping attack. But is there any way to prevent this attack by DNSSEC or IPSEC?
3
votes
0answers
934 views

Do I need DNSSEC from GoDaddy?

I just registered a co.uk domain with GoDaddy. I've been managing domains for a few years now, and hosting my own website. I know a bit, but not enough to be safe with anything important like this. ...
3
votes
1answer
745 views

Why is the DANE protocol depending on DNSSEC?

Why is the DNS-based Authentication of Named Entities (DANE) protocol depending on Domain Name System Security Extensions (DNSSEC)?
1
vote
1answer
340 views

How does the DANE protocol make Certificate Authorities obsolete?

How does the DNS-based Authentication of Named Entities (DANE) protocol make Certificate Authorities (CA) obsolete? In other words: How is it technically possible that DANE does not need Certificate ...
0
votes
1answer
73 views

Would DNSSec and DANE be more secure if the same key was published to different TLDs?

Assuming that it's tough to get many government owned TLDs to cooperate to spoof DANE or DNSSec, would it be wise to publish the same certificate (different SAN names) to various TLDs? For example: ...
0
votes
2answers
287 views

Obtaining the public DNSSEC root key

Is the public DNSKEY of the DNS root zone that I have to trust when validating a DNSSEC key chain usually bundled with an OS? If so where is it located under Ubuntu 15.04, Linux? What is otherwise ...
12
votes
3answers
654 views

Should the average user care about DNS security?

Denise is an average user who goes with the default settings of her OS and home router. She knows that her browser and email client use DNS and she's worried because I told her that the DNS protocol ...
0
votes
2answers
2k views

When using an SSH tunnel does the server resolve domain names or is it still done via the ISP/DNS server on the router?

With the recent UK news on the snoopers charter ISP's will be able to log and store a users Internet activities for up to a year and be made available to the Government. I've started thinking about ...
4
votes
1answer
391 views

Security of DNSSEC without NSEC

DNSSEC uses NSEC (or NSEC3) records to indicate that requested domain name does not exist. NSEC has been criticized because it allows zone enumeration. What breaks, if dnssec is implemented without ...
14
votes
2answers
2k views

What problem does DNSSEC solve?

I have read through the questions tagged DNSSEC on this site, and over the years you hear statistics about DNSSEC adoption and about organizations enabling it on their domains... but nobody mentions ...
5
votes
2answers
190 views

How can I (preferably metaphorically) explain DNSSEC without technical jargon?

How can I explain a non-technical person the purpose of Domain Name System Security Extensions (DNSSEC) and the risks of not using DNSSEC? It would be nice to use a metaphor, so that it's also easy to ...