Questions tagged [dnssec]
Domain Name System Security Extensions (DNSSEC) is a set of IETF specifications for digitally signed DNS.
130
questions
1
vote
2
answers
291
views
What are the implications of using an "unsafe" DNSSEC algorithm like RSA/MD5?
Why is it unsafe to use the DNSSEC algorithm RSA/MD5? In practical terms, how is DNSSEC weakened by the use of an algorithm such as MD5, which has a known weakness of collisions?
RFC 6944 states, ...
- 6,661
1
vote
1
answer
323
views
What is the effect on a domain when the secondary name server is compromised?
I've heard of a case wherein the domain name of the secondary name server was expired and free to register.
Let's say example.com has two registered nameservers:
example-ns1.com (primary)
example-...
- 6,661
0
votes
1
answer
298
views
Is it possible to prevent SSL stripping attack via DNSSEC or IPSEC?
I am pondering about SSL Stripping attack. But is there any way to prevent this attack by DNSSEC or IPSEC?
- 101
3
votes
0
answers
1k
views
Do I need DNSSEC from GoDaddy?
I just registered a co.uk domain with GoDaddy. I've been managing domains for a few years now, and hosting my own website. I know a bit, but not enough to be safe with anything important like this.
...
- 940
3
votes
1
answer
906
views
Why is the DANE protocol depending on DNSSEC?
Why is the DNS-based Authentication of Named Entities (DANE) protocol depending on Domain Name System Security Extensions (DNSSEC)?
- 6,661
2
votes
1
answer
463
views
How does the DANE protocol make Certificate Authorities obsolete?
How does the DNS-based Authentication of Named Entities (DANE) protocol make Certificate Authorities (CA) obsolete?
In other words: How is it technically possible that DANE does not need Certificate ...
- 6,661
0
votes
1
answer
116
views
Would DNSSec and DANE be more secure if the same key was published to different TLDs?
Assuming that it's tough to get many government owned TLDs to cooperate to spoof DANE or DNSSec, would it be wise to publish the same certificate (different SAN names) to various TLDs?
For example:
...
- 50.7k
0
votes
2
answers
552
views
Obtaining the public DNSSEC root key
Is the public DNSKEY of the DNS root zone that I have to trust when validating a DNSSEC key chain usually bundled with an OS? If so where is it located under Ubuntu 15.04, Linux?
What is otherwise ...
- 303
12
votes
3
answers
772
views
Should the average user care about DNS security?
Denise is an average user who goes with the default settings of her OS and home router. She knows that her browser and email client use DNS and she's worried because I told her that the DNS protocol ...
- 44.6k
0
votes
2
answers
4k
views
When using an SSH tunnel does the server resolve domain names or is it still done via the ISP/DNS server on the router?
With the recent UK news on the snoopers charter ISP's will be able to log and store a users Internet activities for up to a year and be made available to the Government. I've started thinking about ...
- 297
4
votes
1
answer
703
views
Security of DNSSEC without NSEC
DNSSEC uses NSEC (or NSEC3) records to indicate that requested domain name does not exist. NSEC has been criticized because it allows zone enumeration.
What breaks, if dnssec is implemented without ...
- 159
14
votes
2
answers
2k
views
What problem does DNSSEC solve?
I have read through the questions tagged DNSSEC on this site, and over the years you hear statistics about DNSSEC adoption and about organizations enabling it on their domains... but nobody mentions ...
- 32.7k
5
votes
3
answers
284
views
How can I (preferably metaphorically) explain DNSSEC without technical jargon?
How can I explain a non-technical person the purpose of Domain Name System Security Extensions (DNSSEC) and the risks of not using DNSSEC? It would be nice to use a metaphor, so that it's also easy to ...
- 6,661
2
votes
1
answer
495
views
Can someone please confirm one of these explanations of the DNSSEC chain of trust?
Let me apologize in advance for this question has been answered. I did have a good look and if it is here somewhere I missed it. My question hopes to clarify exactly what happens when a validating ...
- 21
2
votes
2
answers
359
views
Possible to prevent/limit caching of DNSSec records?
I am looking at the SmartCache service of OpenDNS where it caches authoritative responses.
From a client perspective, is there any way I can use a recursive DNS resolver to determine if the record ...
- 50.7k
2
votes
1
answer
347
views
DNSSEC implementation questions (BIND 9.10)
I am planning to sign multiple DNS zones with BIND and have the following questions which I could not answer by reading the latest BIND 9.10 Reference Manual.
How can I use the same ZSK with multiple ...
- 303
0
votes
2
answers
841
views
Why do SSL enabled sites don't reply back according to "hosts" file record?
I was playing with the hosts file under my linux distro. Added an entry
192.168.3.121 www.facebook.com
in the /etc/hosts file. Created 2 servers which link to an index.html file at ports 80 ...
- 218
1
vote
1
answer
435
views
Questions regarding DNSSEC
Until now I understood the following about DNSSEC:
A client requests a certain Domain let's say google.se
The root server sends the client his public KSK and public ZSK signed by his private KSK so ...
- 113
0
votes
1
answer
246
views
DNSSEC ZSK compromisation (man-in-the-middle attack)
Assuming I am administering a DNS zone and I operate an authoritative name server that is secured with DNSSEC (split ZSK/KSK setup).
When the Zone-Signing-Key (ZSK) ever gets compromised, would it be ...
- 303
5
votes
2
answers
2k
views
What is the purpose of DNS-based Authentication of Named Entities (DANE) and how does it relate to DNSSEC?
What is the purpose of DNS-based Authentication of Named Entities (DANE)? And how does it relate to the Domain Name System Security Extensions (DNSSEC)?
Secondly, how can I verify that DANE is ...
- 6,661
0
votes
2
answers
1k
views
Do I need to use DNScrypt, or can I just set up DNS by myself? What's the point?
So I'm not a fan of having lots of software on my PC, and I was thinking: do I actually need to use DNSCrypt or can I just type in DNS address of one of those private DNS services which do not log ...
- 421
18
votes
2
answers
5k
views
Why do browsers or operating systems not have default DNSSEC validation?
Many resolvers (including TLDs and Root TLDs) support DNSSEC, also Google's OpenDNS servers support it.
Yet it isn't checked on the client side by default. Why is this?
- 878
3
votes
3
answers
16k
views
Is there a point to Dnscrypt when using VPN?
If a computer is already connected to the internet through VPN, is there point in encrypting DNS queries? From DNScrypt:
DNSCrypt is a protocol that authenticates communications between a DNS
...
- 57
7
votes
2
answers
1k
views
Opt into strict DNSSEC checking - does DNSSEC provide a way for a zone to request strict signature validation?
Is there a way for a domain good.com to promise that it will sign all of its DNS records, and that any unsigned records for any host *.good.com should be rejected? In other words, is there a way for ...
- 99.4k
1
vote
2
answers
397
views
Setting up DNSsec for an exotic TLD
I have a .money domain name and I would like to implement DNSSEC. My registrar is GoDaddy and their DNSSEC management system does not support .money.
How can I easily setup DNSSEC for my domain?
- 1,715
2
votes
1
answer
695
views
DNSCrypt-proxy: This certificate looks valid
I have just installed dnscrypt-proxy and dnsmasq with DNSSEC but I get a strange message in the logfile from dnscrypt-proxy.
[INFO] + DNS Security Extensions are supported
[INFO] - [dnscrypt.eu-dk] ...
- 340
4
votes
1
answer
1k
views
How to acquire DNSSEC root trust anchor from IANA?
I want to establish trust in a DNSSEC record. I found, that it can be done
$ dig +sigchase +trusted-key=./root.key @8.8.8.8 eesti.ee
root.key could be obtained with
$ dig . DNSKEY @8.8.8.8 | grep -...
- 41
7
votes
2
answers
5k
views
Can you force your PC or device to use only DNSSec-verified lookup results?
Okay, I'll admit something first-off: I don't really understand some of the practical aspects of how DNSSec protections work very well.(Even after reading resources like this.)
Well, I certainly ...
- 2,735
11
votes
1
answer
4k
views
Is DNSSEC really useless if TLS is properly configured?
I was reading this article http://sockpuppet.org/blog/2015/01/15/against-dnssec/ and this line caught my eye, "With TLS properly configured, DNSSEC adds nothing." My gut reaction was to disagree, but ...
- 918
2
votes
1
answer
794
views
How does DNSSEC work? [closed]
How does my OS or browser knows to check for DNSSEC? How does the verification process works? Do I need a key from Comodo/Verisign? Do I need to install something to my hosting? What happens in men in ...
- 415
3
votes
2
answers
481
views
Is running a DNSSEC enabled DNS service as hard as running a CA?
I think we all know that running a CA is really hard to get right.
Now there's a "new" system that uses digital signatures to associate data with names: DNSSEC. DNSSEC signs the DNS records and ...
- 9,720
7
votes
1
answer
1k
views
Does DNSSEC still have the "enumerate all names in zone" problem?
According to Wikipedia:
DNSSEC introduces the ability for a hostile party to enumerate all the
names in a zone by following the NSEC chain. NSEC RRs assert which
names do not exist in a zone by ...
- 2,194
10
votes
1
answer
790
views
Non-validating DNSSEC aware client security implications
I understood that Windows 7 and newer Windows clients are DNSSEC aware, but that they are non-validating. That means that they are not performing any DNSSEC validation, but that they can require the ...
- 2,299
2
votes
1
answer
2k
views
What if a resolver doesn't support DNSSEC?
I've been reading about DNSSEC lately and had a question about DNS-Resolvers installed elsewhere on the internet.
If a client is using a DNS-Resolver that doesn't support DNSSEC will it fall back to ...
- 145
1
vote
0
answers
2k
views
Vulnerability NTP:Traffic amplification in clrtrap feature of ntpd affect or not affect to Cisco device?
I am using CCSVM tool SCAN for Network devices (Cisco). Below you can find the scan result:
Title vulnerability: NTP: Traffic amplification in clrtrap feature of
ntpd Solution fix: Disable NTP ...
- 11
2
votes
2
answers
750
views
Why do DNSKEY have a RRSIG for themselves?
Looking at all examlpes of DNSSEC, you see that the zone includes not only the DNSKEY , but also a RRSIG of the DNSKEY created with that same DNSKEY? Why is this? Why publish a self-signed RRSIG? What ...
- 83
2
votes
1
answer
860
views
DNSSEC: Why are RRSIGs returned in the "Answer" not "Additional" section?
Looking at Wireshark traces of DNSSEC responses, I see that the RRSIG is returned in the "Answer" section, even though it wasn't part of the query.
Why isn't it returned in the "Additional" Section, ...
- 83
4
votes
3
answers
2k
views
What types of attacks and abuse does DNSSEC protect against?
I've read lots of different articles on what DNSSEC is and that it provides authentication for DNS. What I unfortunately haven't seen is a good description of the types of attacks and abuse that ...
- 6,753
11
votes
1
answer
753
views
Why can't we bypass DNSSEC
DNSSEC is a suite of security extensions to enhance DNS security. (e.g.: avoid cache poisoning)
However I was wondering how does the resolver know that the next NS will use DNSSEC?
E.g.: Someone ...
- 111
3
votes
1
answer
418
views
Does any DNS Recursive resolver accept a "DNSSEC-only" option under DNSCurve?
I want to use DNSCurve (for privacy) to a trusted DNSSec resolver (for integrity), and want to ensure that I can tell a recursive resolver (like 8.8.8.8, or OpenDNS) that I only want DNSSec queries.
...
- 50.7k
3
votes
3
answers
408
views
Does using DNSSEC in parallel with an anonymisation network decrease your privacy?
When using an anonymous communication network like Tor, to ensure privacy you must route your DNS traffic through the system even if your computer always uses DNSSEC for DNS lookups, would this be ...
- 43
7
votes
2
answers
580
views
Is there an HSTS equivalent for DNSSec?
Is there any way to set a DNSSec-always policy similar to how HSTS commands Web Browsers to always use HTTPS?
This would mitigate a DNSSec-strip attack (similar to SSLStrip)
I'm also unclear if this ...
- 50.7k
5
votes
2
answers
251
views
With DNSSEC, is there any benefit in DANE for a CA- issued Cert?
I just deployed DNSSEC at val-id.com and getvalid.com
Since DNSSEC is a requirement of DANE, and I have a CA-based certificate, can I show my support for DANE-based deployments by publishing my CA-...
- 50.7k
2
votes
1
answer
170
views
In DNSSec, are Delegation Signer Records always SHA-1?
I'm creating a RSA/SHA-512 Zone Signing Key and Key Signing Key at Dynect Managed DNS (corporate offering)
The Delegation Signer Record that was created is SHA1. Should I be concerned about this?
- 50.7k
13
votes
2
answers
3k
views
When using https but not DNSSEC, under what situation, a client is vulnerable?
So DNSSEC is to ensure that returned IP address is not poisoned. And https is to verify the remote server.
My question is that when protected by https, under what circumstances, a client is ...
- 133
10
votes
1
answer
670
views
How to get started with DNSSEC?
I have been assigned the task of improving security of a specific service. After some analysis of the requirements we have come to the conclusion, that a certain aspect of the specified requirements ...
- 101
4
votes
2
answers
2k
views
DNSSEC: Does the algorithm of the ZSK need to match the algorithm of the KSK?
I am in the process of setting up DNSSEC for my domains. Initially I was going to go with algorithm 13 (ECDSA-P256-SHA256), but it seems that dyn.com doesn't allow me to add a DS record with an ...
5
votes
2
answers
2k
views
DNSSec vs SSL and IPsec
Theoretically, DNS cache poisoning shouldn't matter,because everything important is protected by SSL and IPsec.
So why DNSSec was developed?
Aren't the first two protocols sufficient?
- 81
2
votes
2
answers
302
views
Security of certificate when using DNSSEC
When setting up secure server, it is suggested not to use self-signed certs and instead to be signed by a CA. Of course, post-Snowden we now know that there may be problems with CA's that could allow ...
- 261
10
votes
2
answers
3k
views
Storing SSL certificates in DNS records
Why not get rid of all certificate authorities and all the special kind of SSL certificates there are (extended validation etc. etc.) and instead just require anyone who wanted SSL to write their own ...
- 367