Questions tagged [dnssec]
Domain Name System Security Extensions (DNSSEC) is a set of IETF specifications for digitally signed DNS.
130
questions
1
vote
1
answer
184
views
How does DNSCurve protect against forgery in a man-in-the-middle attack scenario?
This Question is about DNSCurve. I thought of DNSCurve as "HTTPS for DNS" (like in this Answer) but had some resent thoughts about the trust-relationship between resolvers and nameservers serving the ...
CommunityBot
- 1
8
votes
3
answers
2k
views
Is there a way to use DNS to block access to my domain?
I manage a few dozen servers that are publicly accessible and must remain so. I see very large volumes of malicious traffic on all of these servers. The malicious traffic starts as port scans (...
CommunityBot
- 1
0
votes
1
answer
140
views
Since the DS recordset contains all of the child's Key Signing Key, wouldn't the DS recordset be massive and difficult to load for verification?
I'm learning about DNSSEC today but I don't quite understand about how a parent zone would store all of its child's Key Signing Keys (DNSKEY 257) in its DS record set.
As far as I understand, if I ...
- 1,843
4
votes
1
answer
216
views
How can I validate the root DNS key-signing-key on the command line?
Consider the following dig command and its truncated output:
dig . dnskey +dnssec +multi @a.root-servers.net
...
...
;; ANSWER SECTION:
. 172800 IN DNSKEY 257 3 8 (
...
- 138
0
votes
0
answers
153
views
DNSSEC Client Validation - The Last Mile in DNSSEC
When a Windows computer wants to resolve a domain name, it offloads the request to a DNS resolver and tells the resolver that it wants to resolve with DNSSEC (by setting the 'DO' bit in the query). ...
- 128k
3
votes
1
answer
3k
views
Secure DNS (DoH, DoT) differences, performance, comparison
I am reading up on secure DNS (DoH, DoT) and trying to identify its differences. Currently, I am on https://www.cloudflare.com/learning/dns/dns-over-tls/ page.
Is there for example some non-...
- 9,284
2
votes
2
answers
215
views
Non-TLS-authoritative ZSKs?
Under DANE, the digital chain of trust goes (roughly):
[Public visibility of the ceremony for the generation of the]
ICANN Root Zone Key, which
something something involving the TLD authorities and ...
CommunityBot
- 1
0
votes
1
answer
687
views
What happens if both DoH and DoT are enabled?
If I have DNS over HTTPS and DNS over TLS activated simultaneously (router has DoT activated and smartphone browser has DoH activated, so I see on https://1.1.1.1/help DoH: yes and DoT: yes), which ...
CommunityBot
- 1
4
votes
2
answers
2k
views
DNSSEC: Does the algorithm of the ZSK need to match the algorithm of the KSK?
I am in the process of setting up DNSSEC for my domains. Initially I was going to go with algorithm 13 (ECDSA-P256-SHA256), but it seems that dyn.com doesn't allow me to add a DS record with an ...
- 123
1
vote
1
answer
172
views
What happens if I change RR on my domain's DNS after DNSSEC has already been enabled?
DNSSEC security starts by first grouping DNS records (RR) of the same type into a record set (RRset) and then this RRset gets signed...
Does this mean that I have to completely define all the RR in my ...
CommunityBot
- 1
0
votes
0
answers
84
views
How to properly handle DNSKEY delegation across DNS zones?
I'm trying to implement a toy project DNSSEC supported DNS resolver to learn about both DNS and DNSSEC.
Most of my implementation are finished. But for some domains it's not working correctly, and I ...
- 101
1
vote
1
answer
1k
views
Is Anonymized DNSCrypt over Tor a better alternative to having Doh+ECH?
I use dnscrypt-proxy's anonymized DNScrypt with multiple relays, force it all to use TCP, route them over Tor.
Does this prevent my ISP or anyone in my country to see my DNS queries and client hellos ...
- 66.5k
0
votes
1
answer
198
views
Someone issued fake CAA records for my domain. What is the most important thing to do to resolve it?
First, I can update this with the affected domain, if it's critical, but for obvious reasons I'd like not to be the target of more problems.
Someone registered some CAA records for my domain.
I have ...
CommunityBot
- 1
2
votes
1
answer
77
views
How to identify a name server that does not have DNSSEC implemented?
I tried dig +dnssec dig [domain name] +dnssec +short. Is RRSIG the only attribute to confirm if a name server has DNSSEC implemented or not? How do I identify a name server that has no DNSSEC ...
- 1,843
4
votes
1
answer
2k
views
Can someone explain me the DNSSEC NSEC3 output?
I'm trying to understand how NSEC and NSEC3 records work in DNSSEC. When I query for an non-existent domain with supports NSEC3, I get the following output
$ dig +dnssec NSEC3 gggg.icann.org. | grep -...
- 1,843
0
votes
1
answer
89
views
Suspicious ip address of our mail domain found on talosintelligence.com (spoofing attempt)
We have a fair amount of email traffic. Recently, we had some suspicious email spoofing attacks and a lot of users reported that outgoing emails were marked as spam and landed in junk folder (reported ...
- 11k
1
vote
1
answer
8k
views
Any Cloudflare's DNS over TLS (DoT) check + DNSSEC test?
In my original question from 2020, I was unsuccessful in my effort to setup Cloudflare's (link to docs) DNS over TLS (DoT) (link to wiki) in my old, and now decomissioned, router:
Does Cloudflare'...
- 1,687
1
vote
2
answers
1k
views
Does Cloudflare's DNS over TLS (DoT) implement DNSSEC too?
I am confused about if I decided to implement DNS over TLS (DoT), would I lose DNSSEC?
Details:
I am connected with IPv4 + IPv6 Cloudflare DNS directly in my home OpenWrt router.
I love the idea of ...
- 128k
-1
votes
1
answer
1k
views
DNSSEC is not configured for X website
I'm pretty new to this world of security and I'm doing some challenges trying to solve puzles of security, the thing is I have a website that is not loading it throws a timeout if I do ping, but ...
- 99
1
vote
2
answers
1k
views
Is it possible to create DNSSEC chain of trust for local root zone
I have local (private) root domain domainX.example and subdomains : subdomainY.domainX.example and subdomainZ.domainX.example.
How would I create chain of trust without using root-servers.net?
- 410
5
votes
3
answers
284
views
How can I (preferably metaphorically) explain DNSSEC without technical jargon?
How can I explain a non-technical person the purpose of Domain Name System Security Extensions (DNSSEC) and the risks of not using DNSSEC? It would be nice to use a metaphor, so that it's also easy to ...
- 1,843
2
votes
2
answers
750
views
Why do DNSKEY have a RRSIG for themselves?
Looking at all examlpes of DNSSEC, you see that the zone includes not only the DNSKEY , but also a RRSIG of the DNSKEY created with that same DNSKEY? Why is this? Why publish a self-signed RRSIG? What ...
CommunityBot
- 1
7
votes
2
answers
2k
views
How does a client know that a DNS zone is DNSSEC protected?
Recently, I've been reading about DNSSEC and how it works. I found other questions and some very interesting answers on this and other websites related to this matter.
However, I have a question to ...
1
vote
0
answers
120
views
How to validate DNSSEC signatures - zone cuts?
RFC 4035, section 5.3.1 lays out the rules for validating DNSSEC RRSIG records:
The RRSIG RR and the RRset MUST have the same owner name and the same class.
The RRSIG RR's Signer's Name field MUST be ...
1
vote
0
answers
88
views
Tooling and serialization format for DNSSEC signture chain
I'm looking for a compact, canonical (and possibly but not necessarily human-readable) format for serializing the signature chain for a RRset (or proof that it lies under an insecure delegation) for ...
32
votes
2
answers
99k
views
DNS zone transfer attack
Can anyone explain what is DNS zone transfer attack or give any link, paper?
I have already googled, but could not find anything meaningful.
- 15.5k
1
vote
0
answers
69
views
Supplying registrar with dnssec related records
I have a domain name under .money, which supports DNSSEC.
However, my registrar hasn't done DNSSEC with this TLD before and is asking me to supply the Key Tag, Algorithm Type, Digest Type and Digest --...
- 128k
26
votes
2
answers
7k
views
If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
Looking at all the people who question the viability of DNSSEC, it's no wonder that the adoption rates are so poor.
However, what about DNSCurve? It supposedly fixes all the DNS security and privacy ...
- 267
-1
votes
1
answer
97
views
Can I simplify DNSSEC implementation in a context of public content?
Contents of government gazette, Linux distributions, Open Data, etc. are public, there are no constraints for "increase user privacy". On the contrary, we want to guarantee transparency... ...
- 198k
5
votes
2
answers
4k
views
How can I tell if a DNSSec zone is protected using NSEC3 (versus NSEC)
This answer describes how DNSSec might permit "Zone walking"... where a bad guy can extract all the DNS records from a DNSSec enabled zone. NSEC3 is an update that prevents this. (See bottom of this ...
- 21
35
votes
3
answers
11k
views
If DNSSEC is so useful, why is its deployment non-existent for top domains?
I've read several papers on DNSSEC, and it appears that it does prevent many attack classes, and the only two possible downsides is that its deployment is hard (DNSSEC is complex), and that you can ...
CommunityBot
- 1
1
vote
0
answers
333
views
Detecting a web based MITM attack?
I've been looking into ways to detect a Man In the Middle attack, when the client has "duped" into trusting third party CA. Examples of this are, anti-virus applications and corporate ...
- 11
1
vote
1
answer
133
views
What portion of recursive (ISP, public, etc.) nameservers validate DNSSEC strictly?
I'm adopting/setting up DNSSEC on my domains for the first time, and curious about the practical benefits I can expect. In theory, regardless of whether client/stub resolvers want checking, recursive ...
CommunityBot
- 1
18
votes
2
answers
5k
views
Why do browsers or operating systems not have default DNSSEC validation?
Many resolvers (including TLDs and Root TLDs) support DNSSEC, also Google's OpenDNS servers support it.
Yet it isn't checked on the client side by default. Why is this?
- 31
0
votes
0
answers
80
views
Is there any reason not to enable DNSSEC? [duplicate]
Google Domains' DNS management has a link that says Enable DNSSEC. And, as I understand it, this prevents spoofing of DNS responses. And, that sounds great!
So, why wouldn't I want to enable DNSSEC?
...
- 711
0
votes
1
answer
279
views
DNSSEC - does the domain owner owns a key?
The purpose of DNSSEC is to prevent some attacks like cache poisoning so a client can be sure that the answer it gets from a recursive DNS server are correct (the IP is the correct IP). The root DNS ...
- 1,843
1
vote
0
answers
92
views
How do you mitigate the risk of stolen unencrypted data because you are using Cloud DNS to proxy the request that are sent to your server?
Goal
My goal is to build a PWA. I am new to programming and I believe it is better to start with NGINX.
I have not found a good article (explaining the security risk) about using the Cloud DNS (such ...
- 2,265
31
votes
3
answers
9k
views
How does DNSSec work? Are there known limitations or issues?
Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including:
DNS spoofing, especially on wifi or shared medium
Registrars that abuse their ...
CommunityBot
- 1
17
votes
4
answers
8k
views
DNSSec (Comcast) vs DNSCurve (OpenDNS)
I was previously using OpenDNS on my internal network. I found out today that Comcast has switched over to DNSSec: Comcast DNSSec.
I've done a little research on DNSSec and its benefits. I ...
CommunityBot
- 1
7
votes
2
answers
5k
views
Can you force your PC or device to use only DNSSec-verified lookup results?
Okay, I'll admit something first-off: I don't really understand some of the practical aspects of how DNSSec protections work very well.(Even after reading resources like this.)
Well, I certainly ...
CommunityBot
- 1
2
votes
1
answer
495
views
Can someone please confirm one of these explanations of the DNSSEC chain of trust?
Let me apologize in advance for this question has been answered. I did have a good look and if it is here somewhere I missed it. My question hopes to clarify exactly what happens when a validating ...
- 128k
2
votes
1
answer
193
views
Certificate warning when I enable DNSSEC
I registered mydomain.net (with Google domain registration server). In the DNS settings on the google control panel, I say that mail.mydomain.net should go to the email cloud app (business.zoho.com in ...
- 198k
5
votes
2
answers
251
views
With DNSSEC, is there any benefit in DANE for a CA- issued Cert?
I just deployed DNSSEC at val-id.com and getvalid.com
Since DNSSEC is a requirement of DANE, and I have a CA-based certificate, can I show my support for DANE-based deployments by publishing my CA-...
- 1,843
2
votes
1
answer
739
views
How many times does a DNS server need to sign?
I have a question about DNSSEC and how many times a DNS server must sign or in other words, how many signatures are there in a day. I know that DNSSEC builds on a chain of trust starting at the root ...
CommunityBot
- 1
0
votes
2
answers
218
views
Would DNSSEC and certificates for IP addresses be enough?
Using DNSSEC you can be sure that you have the right IP for a domain and using a certificate for the IP signed by someone you trust you know you have the right IP.
Shouldn't this be enough to know ...
- 3,860
2
votes
2
answers
13k
views
Connecting to my VPN via IP or domain name?
Background:
So I use a private VPS to host my own VPN, rather than pay/trust another company to host it for me. I am an intermittent traveller so it is cheaper for me to spin up or down my server as ...
3
votes
1
answer
1k
views
A third party Web site wants me to validate my domain ownership using a TXT record
What are the security risks with adding TXT records for third party tools? Can they get any information back from your servers with adding that record for them?
The example below is from the "have i ...
- 3,456
0
votes
1
answer
2k
views
Subdomain Scan protection
I have seen that all our subdomains can be eaisly be scanned with help of websites like dnsdumpster.
What is the best way to protect subdomains of any website from getting scanned or revealed via ...
CommunityBot
- 1
1
vote
1
answer
112
views
How can I ensure consistent privacy policy of my DNS server to that of the TLD's privacy policy?
Whenever I query example.com, one of the TLD root servers for .com will be queried for example.com. This query includes my IP address, and in theory could be used to identify my browser session.
...
- 18.7k
6
votes
2
answers
1k
views
Can NSEC domain enumeration happen for zones with wildcard records?
In DNSSEC, NSEC records are used to provide proof of nonexistence. The trouble is that these records provide pointers to existent domain names (the closest known domain in either direction) ...
CommunityBot
- 1