Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [dnssec]

Domain Name System Security Extensions (DNSSEC) is a set of IETF specifications for digitally signed DNS.

1
vote
0answers
27 views

Non-TLS-authoritative ZSKs?

Under DANE, the digital chain of trust goes (roughly): [Public visibility of the ceremony for the generation of the] ICANN Root Zone Key, which something something involving the TLD authorities and ...
0
votes
1answer
62 views

Encapsulating DNSSec into Dot or DoH

I read a few articles on how DNSSec works (here and here). The DNSSec request are not encrypted, and I wanted to know if it's possible to encapsulate it into a DoH or a DoT request?
2
votes
1answer
44 views

Is it critical to enable DNSSEC if I am using TLS/SSL certificate on a website? [duplicate]

I have TLS installed for a website, does it matter if DNSSEC is enabled for this domain or there is no real need for that then?
0
votes
0answers
36 views

How can I find the publick key length of a dnssec public key

I have generated a DNS public-key (as far as I recall it is an rSA key). Given the key (ZSK and KSK), how can I figure our its length? how can I make sure it is RSA or another type? For example, this ...
0
votes
1answer
83 views

Unexplained DNS connections on boot

I was on an Ubuntu VPS today, with a bind9 DNS server (without DNSSEC configured) installed and running. Immediately after booting the machine I ran: netstat -tanp And received this output: Proto ...
1
vote
0answers
36 views

How does DNSCurve protect against forgery in a man-in-the-middle attack scenario?

This Question is about DNSCurve. I thought of DNSCurve as "HTTPS for DNS" (like in this Answer) but had some resent thoughts about the trust-relationship between resolvers and nameservers serving the ...
0
votes
1answer
100 views

DNSSEC - does the domain owner owns a key?

The purpose of DNSSEC is to prevent some attacks like cache poisoning so a client can be sure that the answer it gets from a recursive DNS server are correct (the IP is the correct IP). The root DNS ...
4
votes
2answers
215 views

Do you need DNSSEC if you use HSTS? [duplicate]

I'm trying to understand the benefits of DNSSEC. If a user goes to my site example.com and the DNS cache was poisoned redirecting the user to the bad guy's IP, what would happen? I've enabled HSTS. ...
0
votes
1answer
115 views

Is there any advantage to using encrypted DNS on a VPN server

I have a personal OpenVPN server. I am worried that the fact the DNS resolution coming out of the server isn't encrypted, since I am the only one that uses the server at the moment, attribution isn't ...
1
vote
2answers
2k views

Connecting to my VPN via IP or domain name?

Background: So I use a private VPS to host my own VPN, rather than pay/trust another company to host it for me. I am an intermittent traveller so it is cheaper for me to spin up or down my server as ...
4
votes
1answer
276 views

How DNS hijacking was myetherwallet.com fault even though AWS DNS server was hijacked yesterday

I have been reading on how myetherwallet was hacked a day ago because Amazons domain service was compromised, as mentioned here, https://www.reddit.com/r/ethereum/comments/8ek86t/...
8
votes
1answer
289 views

How to obtain privacy and authenticity with DNS?

I use pfSense (Unbound) as my local resolver. Historically I've pointed it at root recursive resolution, because I perceived my main threat as trustworthiness and recency of data (poisoned/invalid DNS)...
2
votes
2answers
390 views

Is it okay to publish a TLSA records for non-DNSSEC CNAME'ed services?

In the scenario with two domain names example.com secured with DNSSEC example.org not secured with DNSSEC and a mail service running at smtp.example.org: I want to secure the mail service using ...
1
vote
1answer
117 views

How many times does a DNS server need to sign?

I have a question about DNSSEC and how many times a DNS server must sign or in other words, how many signatures are there in a day. I know that DNSSEC builds on a chain of trust starting at the root ...
1
vote
1answer
330 views

Can I use BIND in place of DNSCrypt? [closed]

I was using DNSCrypt on my personal computer (linux). I uninstalled it, and now I'm getting errors reinstalling. I believe development on DNSCrypt was being abandoned anyway, because Cisco/OpenDNS ...
4
votes
1answer
333 views

Is my ISP hosting malware or has it suffered a sub-domain takeover, or is my router compromised?

I'm new to this netsec stuff but I wanted to ask an opinion about what is going on here. I've been doing some web development and have been using Codekit for ages, but recently noticed that it's in-...
2
votes
1answer
164 views

Value of DNSSEC with allow-downgrade option

Does setting up DNSSEC in client (systemd-resolved) with allow-downgrade option have any value? Does it improve security at all?
2
votes
2answers
171 views

DNS Poisoning - How to edit the “list” it in the target server?

I know how to redirect some DNS name to another DNS name. For example, access security.stackexchange.com and redirect to facebook.com. But I am doing this with my own server and the connected ...
2
votes
3answers
595 views

Effects of CVE-2017-9445?

http://thehackernews.com/2017/06/linux-buffer-overflow-code.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9445 "that could allow remote attackers to potentially trigger a buffer ...
2
votes
1answer
473 views

Can someone explain me the DNSSEC NSEC3 output?

I'm trying to understand how NSEC and NSEC3 records work in DNSSEC. When I query for an non-existent domain with supports NSEC3, I get the following output $ dig +dnssec NSEC3 gggg.icann.org. | grep -...
0
votes
1answer
208 views

Is HPKP a alternative to DNSSEC? [duplicate]

Using the Public Key Pinning header the user will only trust in my SSL Certificate, supposedly. If I use only the HPKP and the certificate is safe, the attacker not got it, still possible the ...
2
votes
1answer
221 views

What is a secure DNSKEY bit length and usage time?

During penetration testing I have seen DNSSEC keys with lengths of 1024 and 512 bits. NIST recommends a key length of at least 2048 bits. So is it correct to assume that these DNSKEY's are unsafe to ...
1
vote
2answers
138 views

What are the implications of using an “unsafe” DNSSEC algorithm like RSA/MD5?

Why is it unsafe to use the DNSSEC algorithm RSA/MD5? In practical terms, how is DNSSEC weakened by the use of an algorithm such as MD5, which has a known weakness of collisions? RFC 6944 states, ...
1
vote
1answer
242 views

What is the effect on a domain when the secondary name server is compromised?

I've heard of a case wherein the domain name of the secondary name server was expired and free to register. Let's say example.com has two registered nameservers: example-ns1.com (primary) example-...
0
votes
1answer
172 views

Is it possible to prevent SSL stripping attack via DNSSEC or IPSEC?

I am pondering about SSL Stripping attack. But is there any way to prevent this attack by DNSSEC or IPSEC?
4
votes
0answers
617 views

Do I need DNSSEC from GoDaddy?

I just registered a co.uk domain with GoDaddy. I've been managing domains for a few years now, and hosting my own website. I know a bit, but not enough to be safe with anything important like this. ...
0
votes
1answer
296 views

Why is the DANE protocol depending on DNSSEC?

Why is the DNS-based Authentication of Named Entities (DANE) protocol depending on Domain Name System Security Extensions (DNSSEC)?
1
vote
1answer
222 views

How does the DANE protocol make Certificate Authorities obsolete?

How does the DNS-based Authentication of Named Entities (DANE) protocol make Certificate Authorities (CA) obsolete? In other words: How is it technically possible that DANE does not need Certificate ...
0
votes
1answer
63 views

Would DNSSec and DANE be more secure if the same key was published to different TLDs?

Assuming that it's tough to get many government owned TLDs to cooperate to spoof DANE or DNSSec, would it be wise to publish the same certificate (different SAN names) to various TLDs? For example: ...
0
votes
2answers
151 views

Obtaining the public DNSSEC root key

Is the public DNSKEY of the DNS root zone that I have to trust when validating a DNSSEC key chain usually bundled with an OS? If so where is it located under Ubuntu 15.04, Linux? What is otherwise ...
12
votes
3answers
560 views

Should the average user care about DNS security?

Denise is an average user who goes with the default settings of her OS and home router. She knows that her browser and email client use DNS and she's worried because I told her that the DNS protocol ...
0
votes
2answers
614 views

When using an SSH tunnel does the server resolve domain names or is it still done via the ISP/DNS server on the router?

With the recent UK news on the snoopers charter ISP's will be able to log and store a users Internet activities for up to a year and be made available to the Government. I've started thinking about ...
4
votes
1answer
173 views

Security of DNSSEC without NSEC

DNSSEC uses NSEC (or NSEC3) records to indicate that requested domain name does not exist. NSEC has been criticized because it allows zone enumeration. What breaks, if dnssec is implemented without ...
13
votes
2answers
1k views

What problem does DNSSEC solve?

I have read through the questions tagged DNSSEC on this site, and over the years you hear statistics about DNSSEC adoption and about organizations enabling it on their domains... but nobody mentions ...
5
votes
2answers
153 views

How can I (preferably metaphorically) explain DNSSEC without technical jargon?

How can I explain a non-technical person the purpose of Domain Name System Security Extensions (DNSSEC) and the risks of not using DNSSEC? It would be nice to use a metaphor, so that it's also easy to ...
2
votes
0answers
208 views

Can someone please confirm one of these explanations of the DNSSEC chain of trust?

Let me apologise in advance of this question has been answered. I did have a good look and if it is here somewhere I missed it. My question hopes to clarify exactly what happens when a validating ...
2
votes
2answers
126 views

Possible to prevent/limit caching of DNSSec records?

I am looking at the SmartCache service of OpenDNS where it caches authoritative responses. From a client perspective, is there any way I can use a recursive DNS resolver to determine if the record ...
1
vote
1answer
160 views

DNSSEC implementation questions (BIND 9.10)

I am planning to sign multiple DNS zones with BIND and have the following questions which I could not answer by reading the latest BIND 9.10 Reference Manual. How can I use the same ZSK with multiple ...
0
votes
2answers
345 views

Why do SSL enabled sites don't reply back according to “hosts” file record?

I was playing with the hosts file under my linux distro. Added an entry 192.168.3.121 www.facebook.com in the /etc/hosts file. Created 2 servers which link to an index.html file at ports 80 ...
1
vote
1answer
288 views

Questions regarding DNSSEC

Until now I understood the following about DNSSEC: A client requests a certain Domain let's say google.se The root server sends the client his public KSK and public ZSK signed by his private KSK so ...
0
votes
1answer
102 views

DNSSEC ZSK compromisation (man-in-the-middle attack)

Assuming I am administering a DNS zone and I operate an authoritative name server that is secured with DNSSEC (split ZSK/KSK setup). When the Zone-Signing-Key (ZSK) ever gets compromised, would it be ...
2
votes
2answers
794 views

What is the purpose of DNS-based Authentication of Named Entities (DANE) and how does it relate to DNSSEC?

What is the purpose of DNS-based Authentication of Named Entities (DANE)? And how does it relate to the Domain Name System Security Extensions (DNSSEC)? Secondly, how can I verify that DANE is ...
0
votes
2answers
736 views

Do I need to use DNScrypt, or can I just set up DNS by myself? What's the point?

So I'm not a fan of having lots of software on my PC, and I was thinking: do I actually need to use DNSCrypt or can I just type in DNS address of one of those private DNS services which do not log ...
12
votes
2answers
2k views

Why do browsers or operating systems not have default DNSSEC validation?

Many resolvers (including TLDs and Root TLDs) support DNSSEC, also Google's OpenDNS servers support it. Yet it isn't checked on the client side by default. Why is this?
2
votes
3answers
6k views

Is there a point to Dnscrypt when using VPN?

If a computer is already connected to the internet through VPN, is there point in encrypting DNS queries? From DNScrypt: DNSCrypt is a protocol that authenticates communications between a DNS ...
6
votes
2answers
559 views

Opt into strict DNSSEC checking - does DNSSEC provide a way for a zone to request strict signature validation?

Is there a way for a domain good.com to promise that it will sign all of its DNS records, and that any unsigned records for any host *.good.com should be rejected? In other words, is there a way for ...
1
vote
2answers
98 views

Setting up DNSsec for an exotic TLD

I have a .money domain name and I would like to implement DNSSEC. My registrar is GoDaddy and their DNSSEC management system does not support .money. How can I easily setup DNSSEC for my domain?
2
votes
1answer
419 views

DNSCrypt-proxy: This certificate looks valid

I have just installed dnscrypt-proxy and dnsmasq with DNSSEC but I get a strange message in the logfile from dnscrypt-proxy. [INFO] + DNS Security Extensions are supported [INFO] - [dnscrypt.eu-dk] ...
4
votes
1answer
495 views

How to acquire DNSSEC root trust anchor from IANA?

I want to establish trust in a DNSSEC record. I found, that it can be done $ dig +sigchase +trusted-key=./root.key @8.8.8.8 eesti.ee root.key could be obtained with $ dig . DNSKEY @8.8.8.8 | grep -...
1
vote
2answers
1k views

Can you force your PC or device to use only DNSSec-verified lookup results?

Okay, I'll admit something first-off: I don't really understand some of the practical aspects of how DNSSec protections work very well.(Even after reading resources like this.) Well, I certainly ...