Questions tagged [dnssec]

Domain Name System Security Extensions (DNSSEC) is a set of IETF specifications for digitally signed DNS.

Filter by
Sorted by
Tagged with
31 votes
3 answers

How does DNSSec work? Are there known limitations or issues?

Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including: DNS spoofing, especially on wifi or shared medium Registrars that abuse their ...
makerofthings7's user avatar
32 votes
2 answers

DNS zone transfer attack

Can anyone explain what is DNS zone transfer attack or give any link, paper? I have already googled, but could not find anything meaningful.
user avatar
13 votes
2 answers

When using https but not DNSSEC, under what situation, a client is vulnerable?

So DNSSEC is to ensure that returned IP address is not poisoned. And https is to verify the remote server. My question is that when protected by https, under what circumstances, a client is ...
Eniaczz's user avatar
  • 133
26 votes
2 answers

If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?

Looking at all the people who question the viability of DNSSEC, it's no wonder that the adoption rates are so poor. However, what about DNSCurve? It supposedly fixes all the DNS security and privacy ...
cnst's user avatar
  • 1,924
11 votes
1 answer

Is DNSSEC really useless if TLS is properly configured?

I was reading this article and this line caught my eye, "With TLS properly configured, DNSSEC adds nothing." My gut reaction was to disagree, but ...
mercurial's user avatar
  • 918
10 votes
2 answers

Storing SSL certificates in DNS records

Why not get rid of all certificate authorities and all the special kind of SSL certificates there are (extended validation etc. etc.) and instead just require anyone who wanted SSL to write their own ...
jake192's user avatar
  • 367
5 votes
2 answers

How can I tell if a DNSSec zone is protected using NSEC3 (versus NSEC)

This answer describes how DNSSec might permit "Zone walking"... where a bad guy can extract all the DNS records from a DNSSec enabled zone. NSEC3 is an update that prevents this. (See bottom of this ...
makerofthings7's user avatar
5 votes
1 answer

Is DNSSEC immune to stripping signatures?

In my opinion, it should be possible to forge DNS reply so it doesn't include DS/RRSIG/... parts for any request, thus bypassing DNSSEC validation of resolved domain. Is DNSSEC system immune to this ...
Marek Sebera's user avatar
  • 2,223
35 votes
3 answers

If DNSSEC is so useful, why is its deployment non-existent for top domains?

I've read several papers on DNSSEC, and it appears that it does prevent many attack classes, and the only two possible downsides is that its deployment is hard (DNSSEC is complex), and that you can ...
haimg's user avatar
  • 515
17 votes
4 answers

DNSSec (Comcast) vs DNSCurve (OpenDNS)

I was previously using OpenDNS on my internal network. I found out today that Comcast has switched over to DNSSec: Comcast DNSSec. I've done a little research on DNSSec and its benefits. I ...
coding4fun's user avatar
15 votes
3 answers

Why is RFC4255 (SSHFP) not used for https?

I had this idea a few hours ago, but of course it already exists and there is even an RFC... Why don't we publish the fingerprint for the SSL/TLS certificate via DNS? We need DNSSEC to make sure the ...
Luc's user avatar
  • 32.7k
12 votes
3 answers

Should the average user care about DNS security?

Denise is an average user who goes with the default settings of her OS and home router. She knows that her browser and email client use DNS and she's worried because I told her that the DNS protocol ...
Arminius's user avatar
  • 44.7k
10 votes
1 answer

Non-validating DNSSEC aware client security implications

I understood that Windows 7 and newer Windows clients are DNSSEC aware, but that they are non-validating. That means that they are not performing any DNSSEC validation, but that they can require the ...
pineappleman's user avatar
  • 2,299
9 votes
2 answers

Does DNSSec have any benefit if used with IPSec-enabled IPv6?

I'm not sure if the RFC's support a IPSec-only implementation of DNS, but if it does, what does that mean for DNSSec? Is DNSSec an IPv4-only technology?
makerofthings7's user avatar
7 votes
2 answers

Can you force your PC or device to use only DNSSec-verified lookup results?

Okay, I'll admit something first-off: I don't really understand some of the practical aspects of how DNSSec protections work very well.(Even after reading resources like this.) Well, I certainly ...
mostlyinformed's user avatar
7 votes
1 answer

Does DNSSEC still have the "enumerate all names in zone" problem?

According to Wikipedia: DNSSEC introduces the ability for a hostile party to enumerate all the names in a zone by following the NSEC chain. NSEC RRs assert which names do not exist in a zone by ...
lepe's user avatar
  • 2,194
4 votes
1 answer

How to acquire DNSSEC root trust anchor from IANA?

I want to establish trust in a DNSSEC record. I found, that it can be done $ dig +sigchase +trusted-key=./root.key @ root.key could be obtained with $ dig . DNSKEY @ | grep -...
j2879873's user avatar
4 votes
1 answer

Does DNSSEC provide signed statements that a certain domain does NOT yet support DNSSEC? If not, why not?

In my security class with David Wagner, we talked about some of the reasons why DNSSEC is not widely adopted right now. One of the reasons was that for backward compatibility reasons, clients need to ...
Curious Student's user avatar
3 votes
3 answers

Does using DNSSEC in parallel with an anonymisation network decrease your privacy?

When using an anonymous communication network like Tor, to ensure privacy you must route your DNS traffic through the system even if your computer always uses DNSSEC for DNS lookups, would this be ...
David's user avatar
  • 43
0 votes
3 answers

What organisation(s) is able to recommend a baseline technology set for safe, secure, web browsing?

This is a high level question regarding some recent posts about enhancing web browser security from an end-user perspective. What business/organisation(s) would have: Sufficient technical skill to ...
makerofthings7's user avatar
0 votes
2 answers

Obtaining the public DNSSEC root key

Is the public DNSKEY of the DNS root zone that I have to trust when validating a DNSSEC key chain usually bundled with an OS? If so where is it located under Ubuntu 15.04, Linux? What is otherwise ...
Simon Fromme's user avatar