Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [dnssec]

Domain Name System Security Extensions (DNSSEC) is a set of IETF specifications for digitally signed DNS.

Filter by
Sorted by
Tagged with
2 votes
0 answers
95 views

Does DNSSEC prevent man-in-the-middle at all? [duplicate]

I just watched a video on DNS that explained that if there is a man-in-the-middle or if someone has taken over your resolver, DNSSEC can prevent the responses from being tampered with because the ...
Nasso's user avatar
  • 23
0 votes
0 answers
134 views

Most likely route to hostile domain take-over?

Say a citizen-run journalist site is a target of a hostile government. The site is hosted over HTTPS in a different country, outside the government's reach. However, the site domain name is within ...
anon2328's user avatar
  • 121
0 votes
0 answers
88 views

Understanding DNSSEC NSEC3 output for valid domain name

I am trying to understand NSEC3 record when querying for existing domain name, for NXDOMAIN I understand how it works. RFC has example about WildCard, NODATA & NXDOMAIN So I fired these queries ...
Chits's user avatar
  • 105
8 votes
3 answers
2k views

Is there a way to use DNS to block access to my domain?

I manage a few dozen servers that are publicly accessible and must remain so. I see very large volumes of malicious traffic on all of these servers. The malicious traffic starts as port scans (...
grenade's user avatar
  • 183
0 votes
1 answer
241 views

Since the DS recordset contains all of the child's Key Signing Key, wouldn't the DS recordset be massive and difficult to load for verification?

I'm learning about DNSSEC today but I don't quite understand about how a parent zone would store all of its child's Key Signing Keys (DNSKEY 257) in its DS record set. As far as I understand, if I ...
xenon's user avatar
  • 367
4 votes
1 answer
425 views

How can I validate the root DNS key-signing-key on the command line?

Consider the following dig command and its truncated output: dig . dnskey +dnssec +multi @a.root-servers.net ... ... ;; ANSWER SECTION: . 172800 IN DNSKEY 257 3 8 ( ...
merlin2011's user avatar
3 votes
1 answer
6k views

Secure DNS (DoH, DoT) differences, performance, comparison

I am reading up on secure DNS (DoH, DoT) and trying to identify its differences. Currently, I am on https://www.cloudflare.com/learning/dns/dns-over-tls/ page. Is there for example some non-...
Vlastimil Burián's user avatar
0 votes
0 answers
163 views

How to properly handle DNSKEY delegation across DNS zones?

I'm trying to implement a toy project DNSSEC supported DNS resolver to learn about both DNS and DNSSEC. Most of my implementation are finished. But for some domains it's not working correctly, and I ...
Rix's user avatar
  • 101
2 votes
1 answer
119 views

How to identify a name server that does not have DNSSEC implemented?

I tried dig +dnssec dig [domain name] +dnssec +short. Is RRSIG the only attribute to confirm if a name server has DNSSEC implemented or not? How do I identify a name server that has no DNSSEC ...
Syskey Whiskey's user avatar
1 vote
1 answer
1k views

Is Anonymized DNSCrypt over Tor a better alternative to having Doh+ECH?

I use dnscrypt-proxy's anonymized DNScrypt with multiple relays, force it all to use TCP, route them over Tor. Does this prevent my ISP or anyone in my country to see my DNS queries and client hellos ...
user avatar
0 votes
1 answer
253 views

Someone issued fake CAA records for my domain. What is the most important thing to do to resolve it?

First, I can update this with the affected domain, if it's critical, but for obvious reasons I'd like not to be the target of more problems. Someone registered some CAA records for my domain. I have ...
New Alexandria's user avatar
0 votes
1 answer
993 views

What happens if both DoH and DoT are enabled?

If I have DNS over HTTPS and DNS over TLS activated simultaneously (router has DoT activated and smartphone browser has DoH activated, so I see on https://1.1.1.1/help DoH: yes and DoT: yes), which ...
iwab's user avatar
  • 181
0 votes
1 answer
130 views

Suspicious ip address of our mail domain found on talosintelligence.com (spoofing attempt)

We have a fair amount of email traffic. Recently, we had some suspicious email spoofing attacks and a lot of users reported that outgoing emails were marked as spam and landed in junk folder (reported ...
xleccf's user avatar
  • 3
1 vote
1 answer
9k views

Any Cloudflare's DNS over TLS (DoT) check + DNSSEC test?

In my original question from 2020, I was unsuccessful in my effort to setup Cloudflare's (link to docs) DNS over TLS (DoT) (link to wiki) in my old, and now decomissioned, router: Does Cloudflare'...
Vlastimil Burián's user avatar
-1 votes
1 answer
2k views

DNSSEC is not configured for X website

I'm pretty new to this world of security and I'm doing some challenges trying to solve puzles of security, the thing is I have a website that is not loading it throws a timeout if I do ping, but ...
StuartDTO's user avatar
1 vote
0 answers
183 views

How to validate DNSSEC signatures - zone cuts?

RFC 4035, section 5.3.1 lays out the rules for validating DNSSEC RRSIG records: The RRSIG RR and the RRset MUST have the same owner name and the same class. The RRSIG RR's Signer's Name field MUST be ...
R.. GitHub STOP HELPING ICE's user avatar
1 vote
0 answers
112 views

Tooling and serialization format for DNSSEC signture chain

I'm looking for a compact, canonical (and possibly but not necessarily human-readable) format for serializing the signature chain for a RRset (or proof that it lies under an insecure delegation) for ...
R.. GitHub STOP HELPING ICE's user avatar
1 vote
0 answers
94 views

Supplying registrar with dnssec related records

I have a domain name under .money, which supports DNSSEC. However, my registrar hasn't done DNSSEC with this TLD before and is asking me to supply the Key Tag, Algorithm Type, Digest Type and Digest --...
Mark Koek's user avatar
  • 1,331
1 vote
1 answer
215 views

What happens if I change RR on my domain's DNS after DNSSEC has already been enabled?

DNSSEC security starts by first grouping DNS records (RR) of the same type into a record set (RRset) and then this RRset gets signed... Does this mean that I have to completely define all the RR in my ...
71GA's user avatar
  • 111
-1 votes
1 answer
119 views

Can I simplify DNSSEC implementation in a context of public content?

Contents of government gazette, Linux distributions, Open Data, etc. are public, there are no constraints for "increase user privacy". On the contrary, we want to guarantee transparency... ...
Peter Krauss's user avatar
1 vote
2 answers
1k views

Does Cloudflare's DNS over TLS (DoT) implement DNSSEC too?

I am confused about if I decided to implement DNS over TLS (DoT), would I lose DNSSEC? Details: I am connected with IPv4 + IPv6 Cloudflare DNS directly in my home OpenWrt router. I love the idea of ...
Vlastimil Burián's user avatar
1 vote
0 answers
384 views

Detecting a web based MITM attack?

I've been looking into ways to detect a Man In the Middle attack, when the client has "duped" into trusting third party CA. Examples of this are, anti-virus applications and corporate ...
Paul's user avatar
  • 11
0 votes
0 answers
83 views

Is there any reason not to enable DNSSEC? [duplicate]

Google Domains' DNS management has a link that says Enable DNSSEC. And, as I understand it, this prevents spoofing of DNS responses. And, that sounds great! So, why wouldn't I want to enable DNSSEC? ...
svidgen's user avatar
  • 723
1 vote
0 answers
113 views

How do you mitigate the risk of stolen unencrypted data because you are using Cloud DNS to proxy the request that are sent to your server?

Goal My goal is to build a PWA. I am new to programming and I believe it is better to start with NGINX. I have not found a good article (explaining the security risk) about using the Cloud DNS (such ...
Jason Rich Darmawan's user avatar
1 vote
1 answer
159 views

What portion of recursive (ISP, public, etc.) nameservers validate DNSSEC strictly?

I'm adopting/setting up DNSSEC on my domains for the first time, and curious about the practical benefits I can expect. In theory, regardless of whether client/stub resolvers want checking, recursive ...
R.. GitHub STOP HELPING ICE's user avatar
2 votes
1 answer
232 views

Certificate warning when I enable DNSSEC

I registered mydomain.net (with Google domain registration server). In the DNS settings on the google control panel, I say that mail.mydomain.net should go to the email cloud app (business.zoho.com in ...
Matt's user avatar
  • 313
1 vote
2 answers
1k views

Is it possible to create DNSSEC chain of trust for local root zone

I have local (private) root domain domainX.example and subdomains : subdomainY.domainX.example and subdomainZ.domainX.example. How would I create chain of trust without using root-servers.net?
Mundile's user avatar
  • 21
0 votes
2 answers
247 views

Would DNSSEC and certificates for IP addresses be enough?

Using DNSSEC you can be sure that you have the right IP for a domain and using a certificate for the IP signed by someone you trust you know you have the right IP. Shouldn't this be enough to know ...
Mikael Dúi Bolinder's user avatar
4 votes
1 answer
2k views

A third party Web site wants me to validate my domain ownership using a TXT record

What are the security risks with adding TXT records for third party tools? Can they get any information back from your servers with adding that record for them? The example below is from the "have i ...
john_zombie's user avatar
0 votes
1 answer
2k views

Subdomain Scan protection

I have seen that all our subdomains can be eaisly be scanned with help of websites like dnsdumpster. What is the best way to protect subdomains of any website from getting scanned or revealed via ...
Anant Bhandarkar's user avatar
1 vote
1 answer
133 views

How can I ensure consistent privacy policy of my DNS server to that of the TLD's privacy policy?

Whenever I query example.com, one of the TLD root servers for .com will be queried for example.com. This query includes my IP address, and in theory could be used to identify my browser session. ...
TLDR's user avatar
  • 700
2 votes
2 answers
239 views

Non-TLS-authoritative ZSKs?

Under DANE, the digital chain of trust goes (roughly): [Public visibility of the ceremony for the generation of the] ICANN Root Zone Key, which something something involving the TLD authorities and ...
JamesTheAwesomeDude's user avatar
0 votes
1 answer
463 views

Encapsulating DNSSec into Dot or DoH

I read a few articles on how DNSSec works (here and here). The DNSSec request are not encrypted, and I wanted to know if it's possible to encapsulate it into a DoH or a DoT request?
Warok's user avatar
  • 125
2 votes
1 answer
1k views

Is it critical to enable DNSSEC if I am using TLS/SSL certificate on a website? [duplicate]

I have TLS installed for a website, does it matter if DNSSEC is enabled for this domain or there is no real need for that then?
Motaz M. El Shazly's user avatar
0 votes
1 answer
617 views

Unexplained DNS connections on boot

I was on an Ubuntu VPS today, with a bind9 DNS server (without DNSSEC configured) installed and running. Immediately after booting the machine I ran: netstat -tanp And received this output: Proto ...
uofc's user avatar
  • 135
1 vote
1 answer
218 views

How does DNSCurve protect against forgery in a man-in-the-middle attack scenario?

This Question is about DNSCurve. I thought of DNSCurve as "HTTPS for DNS" (like in this Answer) but had some resent thoughts about the trust-relationship between resolvers and nameservers serving the ...
RD010's user avatar
  • 11
0 votes
1 answer
320 views

DNSSEC - does the domain owner owns a key?

The purpose of DNSSEC is to prevent some attacks like cache poisoning so a client can be sure that the answer it gets from a recursive DNS server are correct (the IP is the correct IP). The root DNS ...
user9371654's user avatar
5 votes
2 answers
1k views

Do you need DNSSEC if you use HSTS? [duplicate]

I'm trying to understand the benefits of DNSSEC. If a user goes to my site example.com and the DNS cache was poisoned redirecting the user to the bad guy's IP, what would happen? I've enabled HSTS. ...
Peter Brumby's user avatar
0 votes
1 answer
470 views

Is there any advantage to using encrypted DNS on a VPN server

I have a personal OpenVPN server. I am worried that the fact the DNS resolution coming out of the server isn't encrypted, since I am the only one that uses the server at the moment, attribution isn't ...
Harvs's user avatar
  • 121
2 votes
2 answers
14k views

Connecting to my VPN via IP or domain name?

Background: So I use a private VPS to host my own VPN, rather than pay/trust another company to host it for me. I am an intermittent traveller so it is cheaper for me to spin up or down my server as ...
Harvs's user avatar
  • 121
5 votes
1 answer
486 views

How DNS hijacking was myetherwallet.com fault even though AWS DNS server was hijacked yesterday

I have been reading on how myetherwallet was hacked a day ago because Amazons domain service was compromised, as mentioned here, https://www.reddit.com/r/ethereum/comments/8ek86t/...
curiator's user avatar
9 votes
1 answer
997 views

How to obtain privacy and authenticity with DNS?

I use pfSense (Unbound) as my local resolver. Historically I've pointed it at root recursive resolution, because I perceived my main threat as trustworthiness and recency of data (poisoned/invalid DNS)...
Stilez's user avatar
  • 1,694
3 votes
2 answers
2k views

Is it okay to publish a TLSA records for non-DNSSEC CNAME'ed services?

In the scenario with two domain names example.com secured with DNSSEC example.org not secured with DNSSEC and a mail service running at smtp.example.org: I want to secure the mail service using TLSA/...
Dons's user avatar
  • 33
2 votes
1 answer
806 views

How many times does a DNS server need to sign?

I have a question about DNSSEC and how many times a DNS server must sign or in other words, how many signatures are there in a day. I know that DNSSEC builds on a chain of trust starting at the root ...
Dr3w Br1ck13's user avatar
1 vote
1 answer
920 views

Can I use BIND in place of DNSCrypt? [closed]

I was using DNSCrypt on my personal computer (linux). I uninstalled it, and now I'm getting errors reinstalling. I believe development on DNSCrypt was being abandoned anyway, because Cisco/OpenDNS ...
Lorax's user avatar
  • 113
4 votes
1 answer
826 views

Is my ISP hosting malware or has it suffered a sub-domain takeover, or is my router compromised?

I'm new to this netsec stuff but I wanted to ask an opinion about what is going on here. I've been doing some web development and have been using Codekit for ages, but recently noticed that it's in-...
T9b's user avatar
  • 143
3 votes
1 answer
810 views

Value of DNSSEC with allow-downgrade option

Does setting up DNSSEC in client (systemd-resolved) with allow-downgrade option have any value? Does it improve security at all?
wilx's user avatar
  • 201
2 votes
2 answers
258 views

DNS Poisoning - How to edit the "list" it in the target server?

I know how to redirect some DNS name to another DNS name. For example, access security.stackexchange.com and redirect to facebook.com. But I am doing this with my own server and the connected ...
ComplexityAlg's user avatar
2 votes
3 answers
686 views

Effects of CVE-2017-9445?

http://thehackernews.com/2017/06/linux-buffer-overflow-code.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9445 "that could allow remote attackers to potentially trigger a buffer ...
user152180's user avatar
5 votes
2 answers
2k views

Can someone explain me the DNSSEC NSEC3 output?

I'm trying to understand how NSEC and NSEC3 records work in DNSSEC. When I query for an non-existent domain with supports NSEC3, I get the following output $ dig +dnssec NSEC3 gggg.icann.org. | grep -...
driver_'s user avatar
  • 51