Questions tagged [dnssec]

Domain Name System Security Extensions (DNSSEC) is a set of IETF specifications for digitally signed DNS.

Filter by
Sorted by
Tagged with
2
votes
1answer
314 views

Can someone please confirm one of these explanations of the DNSSEC chain of trust?

Let me apologize in advance for this question has been answered. I did have a good look and if it is here somewhere I missed it. My question hopes to clarify exactly what happens when a validating ...
2
votes
2answers
205 views

Possible to prevent/limit caching of DNSSec records?

I am looking at the SmartCache service of OpenDNS where it caches authoritative responses. From a client perspective, is there any way I can use a recursive DNS resolver to determine if the record ...
2
votes
1answer
219 views

DNSSEC implementation questions (BIND 9.10)

I am planning to sign multiple DNS zones with BIND and have the following questions which I could not answer by reading the latest BIND 9.10 Reference Manual. How can I use the same ZSK with multiple ...
0
votes
2answers
739 views

Why do SSL enabled sites don't reply back according to "hosts" file record?

I was playing with the hosts file under my linux distro. Added an entry 192.168.3.121 www.facebook.com in the /etc/hosts file. Created 2 servers which link to an index.html file at ports 80 ...
1
vote
1answer
377 views

Questions regarding DNSSEC

Until now I understood the following about DNSSEC: A client requests a certain Domain let's say google.se The root server sends the client his public KSK and public ZSK signed by his private KSK so ...
0
votes
1answer
149 views

DNSSEC ZSK compromisation (man-in-the-middle attack)

Assuming I am administering a DNS zone and I operate an authoritative name server that is secured with DNSSEC (split ZSK/KSK setup). When the Zone-Signing-Key (ZSK) ever gets compromised, would it be ...
4
votes
2answers
2k views

What is the purpose of DNS-based Authentication of Named Entities (DANE) and how does it relate to DNSSEC?

What is the purpose of DNS-based Authentication of Named Entities (DANE)? And how does it relate to the Domain Name System Security Extensions (DNSSEC)? Secondly, how can I verify that DANE is ...
0
votes
2answers
1k views

Do I need to use DNScrypt, or can I just set up DNS by myself? What's the point?

So I'm not a fan of having lots of software on my PC, and I was thinking: do I actually need to use DNSCrypt or can I just type in DNS address of one of those private DNS services which do not log ...
16
votes
2answers
4k views

Why do browsers or operating systems not have default DNSSEC validation?

Many resolvers (including TLDs and Root TLDs) support DNSSEC, also Google's OpenDNS servers support it. Yet it isn't checked on the client side by default. Why is this?
3
votes
3answers
14k views

Is there a point to Dnscrypt when using VPN?

If a computer is already connected to the internet through VPN, is there point in encrypting DNS queries? From DNScrypt: DNSCrypt is a protocol that authenticates communications between a DNS ...
7
votes
2answers
968 views

Opt into strict DNSSEC checking - does DNSSEC provide a way for a zone to request strict signature validation?

Is there a way for a domain good.com to promise that it will sign all of its DNS records, and that any unsigned records for any host *.good.com should be rejected? In other words, is there a way for ...
1
vote
2answers
196 views

Setting up DNSsec for an exotic TLD

I have a .money domain name and I would like to implement DNSSEC. My registrar is GoDaddy and their DNSSEC management system does not support .money. How can I easily setup DNSSEC for my domain?
2
votes
1answer
581 views

DNSCrypt-proxy: This certificate looks valid

I have just installed dnscrypt-proxy and dnsmasq with DNSSEC but I get a strange message in the logfile from dnscrypt-proxy. [INFO] + DNS Security Extensions are supported [INFO] - [dnscrypt.eu-dk] ...
4
votes
1answer
982 views

How to acquire DNSSEC root trust anchor from IANA?

I want to establish trust in a DNSSEC record. I found, that it can be done $ dig +sigchase +trusted-key=./root.key @8.8.8.8 eesti.ee root.key could be obtained with $ dig . DNSKEY @8.8.8.8 | grep -...
7
votes
2answers
4k views

Can you force your PC or device to use only DNSSec-verified lookup results?

Okay, I'll admit something first-off: I don't really understand some of the practical aspects of how DNSSec protections work very well.(Even after reading resources like this.) Well, I certainly ...
10
votes
1answer
3k views

Is DNSSEC really useless if TLS is properly configured?

I was reading this article http://sockpuppet.org/blog/2015/01/15/against-dnssec/ and this line caught my eye, "With TLS properly configured, DNSSEC adds nothing." My gut reaction was to disagree, but ...
2
votes
1answer
713 views

How does DNSSEC work? [closed]

How does my OS or browser knows to check for DNSSEC? How does the verification process works? Do I need a key from Comodo/Verisign? Do I need to install something to my hosting? What happens in men in ...
3
votes
2answers
331 views

Is running a DNSSEC enabled DNS service as hard as running a CA?

I think we all know that running a CA is really hard to get right. Now there's a "new" system that uses digital signatures to associate data with names: DNSSEC. DNSSEC signs the DNS records and ...
6
votes
1answer
835 views

Does DNSSEC still have the "enumerate all names in zone" problem?

According to Wikipedia: DNSSEC introduces the ability for a hostile party to enumerate all the names in a zone by following the NSEC chain. NSEC RRs assert which names do not exist in a zone by ...
9
votes
1answer
589 views

Non-validating DNSSEC aware client security implications

I understood that Windows 7 and newer Windows clients are DNSSEC aware, but that they are non-validating. That means that they are not performing any DNSSEC validation, but that they can require the ...
1
vote
1answer
2k views

What if a resolver doesn't support DNSSEC?

I've been reading about DNSSEC lately and had a question about DNS-Resolvers installed elsewhere on the internet. If a client is using a DNS-Resolver that doesn't support DNSSEC will it fall back to ...
1
vote
0answers
1k views

Vulnerability NTP:Traffic amplification in clrtrap feature of ntpd affect or not affect to Cisco device?

I am using CCSVM tool SCAN for Network devices (Cisco). Below you can find the scan result: Title vulnerability: NTP: Traffic amplification in clrtrap feature of ntpd Solution fix: Disable NTP ...
2
votes
2answers
471 views

Why do DNSKEY have a RRSIG for themselves?

Looking at all examlpes of DNSSEC, you see that the zone includes not only the DNSKEY , but also a RRSIG of the DNSKEY created with that same DNSKEY? Why is this? Why publish a self-signed RRSIG? What ...
2
votes
1answer
493 views

DNSSEC: Why are RRSIGs returned in the "Answer" not "Additional" section?

Looking at Wireshark traces of DNSSEC responses, I see that the RRSIG is returned in the "Answer" section, even though it wasn't part of the query. Why isn't it returned in the "Additional" Section, ...
4
votes
3answers
2k views

What types of attacks and abuse does DNSSEC protect against?

I've read lots of different articles on what DNSSEC is and that it provides authentication for DNS. What I unfortunately haven't seen is a good description of the types of attacks and abuse that ...
11
votes
1answer
549 views

Why can't we bypass DNSSEC

DNSSEC is a suite of security extensions to enhance DNS security. (e.g.: avoid cache poisoning) However I was wondering how does the resolver know that the next NS will use DNSSEC? E.g.: Someone ...
3
votes
1answer
348 views

Does any DNS Recursive resolver accept a "DNSSEC-only" option under DNSCurve?

I want to use DNSCurve (for privacy) to a trusted DNSSec resolver (for integrity), and want to ensure that I can tell a recursive resolver (like 8.8.8.8, or OpenDNS) that I only want DNSSec queries. ...
3
votes
3answers
317 views

Does using DNSSEC in parallel with an anonymisation network decrease your privacy?

When using an anonymous communication network like Tor, to ensure privacy you must route your DNS traffic through the system even if your computer always uses DNSSEC for DNS lookups, would this be ...
7
votes
2answers
515 views

Is there an HSTS equivalent for DNSSec?

Is there any way to set a DNSSec-always policy similar to how HSTS commands Web Browsers to always use HTTPS? This would mitigate a DNSSec-strip attack (similar to SSLStrip) I'm also unclear if this ...
5
votes
2answers
197 views

With DNSSEC, is there any benefit in DANE for a CA- issued Cert?

I just deployed DNSSEC at val-id.com and getvalid.com Since DNSSEC is a requirement of DANE, and I have a CA-based certificate, can I show my support for DANE-based deployments by publishing my CA-...
2
votes
1answer
122 views

In DNSSec, are Delegation Signer Records always SHA-1?

I'm creating a RSA/SHA-512 Zone Signing Key and Key Signing Key at Dynect Managed DNS (corporate offering) The Delegation Signer Record that was created is SHA1. Should I be concerned about this?
12
votes
2answers
2k views

When using https but not DNSSEC, under what situation, a client is vulnerable?

So DNSSEC is to ensure that returned IP address is not poisoned. And https is to verify the remote server. My question is that when protected by https, under what circumstances, a client is ...
10
votes
1answer
550 views

How to get started with DNSSEC?

I have been assigned the task of improving security of a specific service. After some analysis of the requirements we have come to the conclusion, that a certain aspect of the specified requirements ...
4
votes
2answers
2k views

DNSSEC: Does the algorithm of the ZSK need to match the algorithm of the KSK?

I am in the process of setting up DNSSEC for my domains. Initially I was going to go with algorithm 13 (ECDSA-P256-SHA256), but it seems that dyn.com doesn't allow me to add a DS record with an ...
5
votes
2answers
2k views

DNSSec vs SSL and IPsec

Theoretically, DNS cache poisoning shouldn't matter,because everything important is protected by SSL and IPsec. So why DNSSec was developed? Aren't the first two protocols sufficient?
2
votes
2answers
218 views

Security of certificate when using DNSSEC

When setting up secure server, it is suggested not to use self-signed certs and instead to be signed by a CA. Of course, post-Snowden we now know that there may be problems with CA's that could allow ...
10
votes
2answers
2k views

Storing SSL certificates in DNS records

Why not get rid of all certificate authorities and all the special kind of SSL certificates there are (extended validation etc. etc.) and instead just require anyone who wanted SSL to write their own ...
9
votes
2answers
2k views

Is the Google address being spoofed on my computer?

I might use some inappropriate terminology because I am no expert, but please feel free to correct me where it is needed. I believe that a process has modified some network file on my computer, like ...
5
votes
0answers
133 views

What's stopping DANE? [closed]

As I understand it, DANE (RFC 6698) is a promising candidate for addressing issues with current TLS Trust Anchors (i.e. Trust Anchors). My attempt at explaining the issue: Currently, CAs are ...
2
votes
1answer
186 views

Why is it dangerous for attackers to be able to enumerate all subdomains of a given domain?

While it seems like a bad idea for attackers to be able to use DNSSEC to enumerate subdomains, I cannot think of a specific attack that this information enables, which would not be doable without this ...
3
votes
1answer
281 views

Email, Certificates and DANE [closed]

Does DANE offer the ability to provide certificates for services? Or is it just hosts? How does one specify a mail server with DANE? If my email is jd@foo.com but mail.bar.com is the email server, ...
3
votes
1answer
390 views

Does DNSSEC provide signed statements that a certain domain does NOT yet support DNSSEC? If not, why not?

In my security class with David Wagner, we talked about some of the reasons why DNSSEC is not widely adopted right now. One of the reasons was that for backward compatibility reasons, clients need to ...
5
votes
1answer
1k views

Is DNSSEC immune to stripping signatures?

In my opinion, it should be possible to forge DNS reply so it doesn't include DS/RRSIG/... parts for any request, thus bypassing DNSSEC validation of resolved domain. Is DNSSEC system immune to this ...
14
votes
2answers
3k views

DNSSEC signing algorithms

Virtualmin supports a flurry of algorithms for DNSSEC: RSASHA1, RSASHA256, RSAMD5, DSA, DH, HMAC-MD5(???), NSEC3RSASHA1, NSEC3DSA. If I understand correctly, there's Proof of Concept available for ...
5
votes
3answers
956 views

Why does DNSSEC have a ridiculous keysigning ceremony?

Every three months, 7 people fly to a secure ICANN server building and go through an elaborate ceremony to generate a new signing key for DNSSEC. The entire affair appears to be based on politics and ...
5
votes
2answers
2k views

How does a client know that a DNS zone is DNSSEC protected?

Recently, I've been reading about DNSSEC and how it works. I found other questions and some very interesting answers on this and other websites related to this matter. However, I have a question to ...
26
votes
2answers
7k views

If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?

Looking at all the people who question the viability of DNSSEC, it's no wonder that the adoption rates are so poor. However, what about DNSCurve? It supposedly fixes all the DNS security and privacy ...
14
votes
3answers
1k views

Why is RFC4255 (SSHFP) not used for https?

I had this idea a few hours ago, but of course it already exists and there is even an RFC... Why don't we publish the fingerprint for the SSL/TLS certificate via DNS? We need DNSSEC to make sure the ...
4
votes
1answer
3k views

How to verify DNSKEY by using its corresponding DS

A DNSKEY on a name server can be verified by using it DS stored on its parental name server. According to RFC4034: The DS record refers to a DNSKEY RR by including a digest of that DNSKEY RR. The ...
30
votes
3answers
8k views

If DNSSEC is so useful, why is its deployment non-existent for top domains?

I've read several papers on DNSSEC, and it appears that it does prevent many attack classes, and the only two possible downsides is that its deployment is hard (DNSSEC is complex), and that you can ...