Questions tagged [dnssec]

Domain Name System Security Extensions (DNSSEC) is a set of IETF specifications for digitally signed DNS.

10 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
0answers
945 views

Do I need DNSSEC from GoDaddy?

I just registered a co.uk domain with GoDaddy. I've been managing domains for a few years now, and hosting my own website. I know a bit, but not enough to be safe with anything important like this. ...
1
vote
0answers
25 views

Supplying registrar with dnssec related records

I have a domain name under .money, which supports DNSSEC. However, my registrar hasn't done DNSSEC with this TLD before and is asking me to supply the Key Tag, Algorithm Type, Digest Type and Digest --...
1
vote
0answers
120 views

Detecting a web based MITM attack?

I've been looking into ways to detect a Man In the Middle attack, when the client has "duped" into trusting third party CA. Examples of this are, anti-virus applications and corporate ...
1
vote
0answers
42 views

How do you mitigate the risk of stolen unencrypted data because you are using Cloud DNS to proxy the request that are sent to your server?

Goal My goal is to build a PWA. I am new to programming and I believe it is better to start with NGINX. I have not found a good article (explaining the security risk) about using the Cloud DNS (such ...
1
vote
0answers
116 views

Non-TLS-authoritative ZSKs?

Under DANE, the digital chain of trust goes (roughly): [Public visibility of the ceremony for the generation of the] ICANN Root Zone Key, which something something involving the TLD authorities and ...
1
vote
0answers
78 views

How does DNSCurve protect against forgery in a man-in-the-middle attack scenario?

This Question is about DNSCurve. I thought of DNSCurve as "HTTPS for DNS" (like in this Answer) but had some resent thoughts about the trust-relationship between resolvers and nameservers serving the ...
1
vote
0answers
1k views

Vulnerability NTP:Traffic amplification in clrtrap feature of ntpd affect or not affect to Cisco device?

I am using CCSVM tool SCAN for Network devices (Cisco). Below you can find the scan result: Title vulnerability: NTP: Traffic amplification in clrtrap feature of ntpd Solution fix: Disable NTP ...
0
votes
0answers
24 views

How to validate DNSSEC signatures - zone cuts?

RFC 4035, section 5.3.1 lays out the rules for validating DNSSEC RRSIG records: The RRSIG RR and the RRset MUST have the same owner name and the same class. The RRSIG RR's Signer's Name field MUST be ...
0
votes
0answers
42 views

Tooling and serialization format for DNSSEC signture chain

I'm looking for a compact, canonical (and possibly but not necessarily human-readable) format for serializing the signature chain for a RRset (or proof that it lies under an insecure delegation) for ...
0
votes
1answer
45 views

What happens if I change RR on my domain's DNS after DNSSEC has already been enabled?

DNSSEC security starts by first grouping DNS records (RR) of the same type into a record set (RRset) and then this RRset gets signed... Does this mean that I have to completely define all the RR in my ...