Questions tagged [dnssec]
Domain Name System Security Extensions (DNSSEC) is a set of IETF specifications for digitally signed DNS.
136 questions
37
votes
3
answers
12k
views
If DNSSEC is so useful, why is its deployment non-existent for top domains?
I've read several papers on DNSSEC, and it appears that it does prevent many attack classes, and the only two possible downsides is that its deployment is hard (DNSSEC is complex), and that you can ...
- 535
32
votes
2
answers
100k
views
DNS zone transfer attack
Can anyone explain what is DNS zone transfer attack or give any link, paper?
I have already googled, but could not find anything meaningful.
user6809
31
votes
3
answers
9k
views
How does DNSSec work? Are there known limitations or issues?
Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including:
DNS spoofing, especially on wifi or shared medium
Registrars that abuse their ...
- 51.1k
26
votes
2
answers
7k
views
If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
Looking at all the people who question the viability of DNSSEC, it's no wonder that the adoption rates are so poor.
However, what about DNSCurve? It supposedly fixes all the DNS security and privacy ...
- 1,984
18
votes
4
answers
5k
views
Does Tor Hidden Service Protocol provide more threat protection than a standard HTTPS session?
DuckDuckGo is a search engine that has a Tor Exit Enclave and hidden service. This site is focused on the safe, secure searching of its users.
Since DNS is not used in Tor, it appears that HTTPS is ...
- 51.1k
17
votes
4
answers
8k
views
DNSSec (Comcast) vs DNSCurve (OpenDNS)
I was previously using OpenDNS on my internal network. I found out today that Comcast has switched over to DNSSec: Comcast DNSSec.
I've done a little research on DNSSec and its benefits. I ...
- 293
17
votes
2
answers
5k
views
Why do browsers or operating systems not have default DNSSEC validation?
Many resolvers (including TLDs and Root TLDs) support DNSSEC, also Google's OpenDNS servers support it.
Yet it isn't checked on the client side by default. Why is this?
- 868
15
votes
3
answers
1k
views
Why is RFC4255 (SSHFP) not used for https?
I had this idea a few hours ago, but of course it already exists and there is even an RFC...
Why don't we publish the fingerprint for the SSL/TLS certificate via DNS? We need DNSSEC to make sure the ...
- 33.1k
15
votes
2
answers
4k
views
DNSSEC signing algorithms
Virtualmin supports a flurry of algorithms for DNSSEC: RSASHA1, RSASHA256, RSAMD5, DSA, DH, HMAC-MD5(???), NSEC3RSASHA1, NSEC3DSA.
If I understand correctly, there's Proof of Concept available for ...
- 257
14
votes
2
answers
3k
views
What problem does DNSSEC solve?
I have read through the questions tagged DNSSEC on this site, and over the years you hear statistics about DNSSEC adoption and about organizations enabling it on their domains... but nobody mentions ...
- 33.1k
14
votes
2
answers
3k
views
When using https but not DNSSEC, under what situation, a client is vulnerable?
So DNSSEC is to ensure that returned IP address is not poisoned. And https is to verify the remote server.
My question is that when protected by https, under what circumstances, a client is ...
- 143
12
votes
3
answers
832
views
Should the average user care about DNS security?
Denise is an average user who goes with the default settings of her OS and home router. She knows that her browser and email client use DNS and she's worried because I told her that the DNS protocol ...
- 45.1k
12
votes
1
answer
5k
views
Is DNSSEC really useless if TLS is properly configured?
I was reading this article http://sockpuppet.org/blog/2015/01/15/against-dnssec/ and this line caught my eye, "With TLS properly configured, DNSSEC adds nothing." My gut reaction was to disagree, but ...
- 918
11
votes
1
answer
862
views
Why can't we bypass DNSSEC
DNSSEC is a suite of security extensions to enhance DNS security. (e.g.: avoid cache poisoning)
However I was wondering how does the resolver know that the next NS will use DNSSEC?
E.g.: Someone ...
- 111
10
votes
2
answers
3k
views
Storing SSL certificates in DNS records
Why not get rid of all certificate authorities and all the special kind of SSL certificates there are (extended validation etc. etc.) and instead just require anyone who wanted SSL to write their own ...
- 367
10
votes
1
answer
731
views
How to get started with DNSSEC?
I have been assigned the task of improving security of a specific service. After some analysis of the requirements we have come to the conclusion, that a certain aspect of the specified requirements ...
- 101
10
votes
1
answer
903
views
Non-validating DNSSEC aware client security implications
I understood that Windows 7 and newer Windows clients are DNSSEC aware, but that they are non-validating. That means that they are not performing any DNSSEC validation, but that they can require the ...
- 2,299
9
votes
2
answers
2k
views
Is the Google address being spoofed on my computer?
I might use some inappropriate terminology because I am no expert, but please feel free to correct me where it is needed.
I believe that a process has modified some network file on my computer, like ...
- 203
9
votes
2
answers
2k
views
Does DNSSec have any benefit if used with IPSec-enabled IPv6?
I'm not sure if the RFC's support a IPSec-only implementation of DNS, but if it does, what does that mean for DNSSec?
Is DNSSec an IPv4-only technology?
- 51.1k
9
votes
1
answer
1k
views
How to obtain privacy and authenticity with DNS?
I use pfSense (Unbound) as my local resolver. Historically I've pointed it at root recursive resolution, because I perceived my main threat as trustworthiness and recency of data (poisoned/invalid DNS)...
- 1,694
8
votes
3
answers
2k
views
Is there a way to use DNS to block access to my domain?
I manage a few dozen servers that are publicly accessible and must remain so. I see very large volumes of malicious traffic on all of these servers. The malicious traffic starts as port scans (...
- 183
7
votes
1
answer
364
views
Does dnssec protect against malicious registrars?
With the recent conspiracy theories around the registrar MarkMonitor Inc., the question arises, if DNSSEC protects against a registrar going malicious (or being attacked).
This is especially ...
- 27.3k
7
votes
1
answer
6k
views
How to test the validity of DNSSEC from a command line interface?
I am doing a research project on The Domain Name System Security Extensions (DNSSEC).
I have a SOA, Stub resolver and a client as well as a attack machine.
My question is this. Is there a way to ...
- 71
7
votes
1
answer
1k
views
Does DNSSEC still have the "enumerate all names in zone" problem?
According to Wikipedia:
DNSSEC introduces the ability for a hostile party to enumerate all the
names in a zone by following the NSEC chain. NSEC RRs assert which
names do not exist in a zone by ...
- 2,204
7
votes
3
answers
1k
views
Is the Kaminsky bug still a problem for sites without DNSSEC?
I have read about the Kaminsky bug, but I don't fully understand how easy it is to use this vulnerability for an attacker.
Are DNS-software updated now so it's not that easy to use this vulnerability ...
- 5,233
7
votes
2
answers
2k
views
How does a client know that a DNS zone is DNSSEC protected?
Recently, I've been reading about DNSSEC and how it works. I found other questions and some very interesting answers on this and other websites related to this matter.
However, I have a question to ...
- 173
7
votes
1
answer
485
views
What is the status of forced HTTPS everywhere (Strict transport security) via DNS? I only see the July 2010 draft
I'm trying to find the most recent RFC on HSTS in DNS (or rather said DNSSEC), but can only find this year old one in expired draft status
Where can I find the most current guidance on STS in DNS? If ...
- 51.1k
7
votes
2
answers
1k
views
Opt into strict DNSSEC checking - does DNSSEC provide a way for a zone to request strict signature validation?
Is there a way for a domain good.com to promise that it will sign all of its DNS records, and that any unsigned records for any host *.good.com should be rejected? In other words, is there a way for ...
- 100k
7
votes
2
answers
6k
views
Can you force your PC or device to use only DNSSec-verified lookup results?
Okay, I'll admit something first-off: I don't really understand some of the practical aspects of how DNSSec protections work very well.(Even after reading resources like this.)
Well, I certainly ...
- 2,815
7
votes
2
answers
610
views
Is there an HSTS equivalent for DNSSec?
Is there any way to set a DNSSec-always policy similar to how HSTS commands Web Browsers to always use HTTPS?
This would mitigate a DNSSec-strip attack (similar to SSLStrip)
I'm also unclear if this ...
- 51.1k
6
votes
2
answers
1k
views
Can NSEC domain enumeration happen for zones with wildcard records?
In DNSSEC, NSEC records are used to provide proof of nonexistence. The trouble is that these records provide pointers to existent domain names (the closest known domain in either direction) ...
- 2,821
5
votes
2
answers
4k
views
How can I tell if a DNSSec zone is protected using NSEC3 (versus NSEC)
This answer describes how DNSSec might permit "Zone walking"... where a bad guy can extract all the DNS records from a DNSSec enabled zone. NSEC3 is an update that prevents this. (See bottom of this ...
- 51.1k
5
votes
1
answer
10k
views
Secure DNS (DoH, DoT) differences, performance, comparison
I am reading up on secure DNS (DoH, DoT) and trying to identify its differences. Currently, I am on https://www.cloudflare.com/learning/dns/dns-over-tls/ page.
Is there for example some non-...
- 1,737
5
votes
3
answers
312
views
How can I (preferably metaphorically) explain DNSSEC without technical jargon?
How can I explain a non-technical person the purpose of Domain Name System Security Extensions (DNSSEC) and the risks of not using DNSSEC? It would be nice to use a metaphor, so that it's also easy to ...
- 7,085
5
votes
3
answers
1k
views
Why does DNSSEC have a ridiculous keysigning ceremony?
Every three months, 7 people fly to a secure ICANN server building and go through an elaborate ceremony to generate a new signing key for DNSSEC. The entire affair appears to be based on politics and ...
- 872
5
votes
1
answer
610
views
Kaminsky Bug Exploitation
I am trying to exploit the Kaminsky bug for a school assignment. The specific version of the bug that I want to exploit is sending a forged packet with false information about www.domain.com so that ...
- 153
5
votes
2
answers
1k
views
Do you need DNSSEC if you use HSTS? [duplicate]
I'm trying to understand the benefits of DNSSEC.
If a user goes to my site example.com and the DNS cache was poisoned redirecting the user to the bad guy's IP, what would happen?
I've enabled HSTS.
...
- 53
5
votes
2
answers
2k
views
What is the purpose of DNS-based Authentication of Named Entities (DANE) and how does it relate to DNSSEC?
What is the purpose of DNS-based Authentication of Named Entities (DANE)? And how does it relate to the Domain Name System Security Extensions (DNSSEC)?
Secondly, how can I verify that DANE is ...
- 7,085
5
votes
1
answer
1k
views
Is DNSSEC immune to stripping signatures?
In my opinion, it should be possible to forge DNS reply so it doesn't include DS/RRSIG/... parts for any request, thus bypassing DNSSEC validation of resolved domain.
Is DNSSEC system immune to this ...
- 2,253
5
votes
1
answer
493
views
How DNS hijacking was myetherwallet.com fault even though AWS DNS server was hijacked yesterday
I have been reading on how myetherwallet was hacked a day ago because Amazons domain service was compromised, as mentioned here,
https://www.reddit.com/r/ethereum/comments/8ek86t/...
- 51
5
votes
2
answers
2k
views
Can someone explain me the DNSSEC NSEC3 output?
I'm trying to understand how NSEC and NSEC3 records work in DNSSEC. When I query for an non-existent domain with supports NSEC3, I get the following output
$ dig +dnssec NSEC3 gggg.icann.org. | grep -...
- 51
5
votes
1
answer
315
views
How exactly would SOPA-style DNS blocking threaten the security of the Internet?
A point that keeps getting mentioned in the SOPA debate is that the DNS blocking it prescribes will cause security problems. Can somebody explain in simple terms just exactly how SOPA threatens ...
- 159
5
votes
1
answer
4k
views
How to verify DNSKEY by using its corresponding DS
A DNSKEY on a name server can be verified by using it DS stored on its parental name server. According to RFC4034: The DS record refers to a DNSKEY RR by including a digest of that DNSKEY RR.
The ...
- 191
5
votes
1
answer
585
views
How can I validate the root DNS key-signing-key on the command line?
Consider the following dig command and its truncated output:
dig . dnskey +dnssec +multi @a.root-servers.net
...
...
;; ANSWER SECTION:
. 172800 IN DNSKEY 257 3 8 (
...
- 153
5
votes
2
answers
276
views
With DNSSEC, is there any benefit in DANE for a CA- issued Cert?
I just deployed DNSSEC at val-id.com and getvalid.com
Since DNSSEC is a requirement of DANE, and I have a CA-based certificate, can I show my support for DANE-based deployments by publishing my CA-...
- 51.1k
5
votes
2
answers
3k
views
DNSSec vs SSL and IPsec
Theoretically, DNS cache poisoning shouldn't matter,because everything important is protected by SSL and IPsec.
So why DNSSec was developed?
Aren't the first two protocols sufficient?
- 81
5
votes
0
answers
210
views
What's stopping DANE? [closed]
As I understand it, DANE (RFC 6698) is a promising candidate for addressing issues with current TLS Trust Anchors (i.e. Trust Anchors).
My attempt at explaining the issue:
Currently, CAs are universal ...
- 268
4
votes
1
answer
2k
views
A third party Web site wants me to validate my domain ownership using a TXT record
What are the security risks with adding TXT records for third party tools? Can they get any information back from your servers with adding that record for them?
The example below is from the "have i ...
- 345
4
votes
1
answer
379
views
How will users know if their session is DNSSec protected or not?
There is definite security value in having DNSSec-verified connections, however I have yet to see software indicate if the connection is secure.
Ultimately I would like my users to recognize that ...
- 51.1k
4
votes
2
answers
3k
views
DNSSEC: Does the algorithm of the ZSK need to match the algorithm of the KSK?
I am in the process of setting up DNSSEC for my domains. Initially I was going to go with algorithm 13 (ECDSA-P256-SHA256), but it seems that dyn.com doesn't allow me to add a DS record with an ...
