Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

With some people wondering how DNSSEC could affect global censorship, I'd like to know if DNSSEC could protect a zone from being partially modified by a grandparent zone. (The point of this question is not to suggest that ICANN or it's members are not be trusted, but to figure out how DNSSEC affects the power they could exercise in theory.)

For example:

  • ICANN owns the root zone
  • The .de zone is delegated to DENIC, Germany.
  • Assume example.de is delegated to some 3rd party.

Now, assuming DENIC does not remove example.de from their zone, would it be possible for them to redirect the subdomain abc.example.de elsewhere by returning signed records from the .de servers for abc.example.de ?

Similarly, would it be possible for the DNS root to easily return signed fake records of a third-level domain xy.z while the second-level zone z is not participating in this and is not affected otherwise?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Your parents always have the ability to mess with your zone. Unfortunately you need to trust them.

Technically, .de would sign a DS record which is a hash of the DNSKEY that is used for signing example.de. If .de is doing the right thing and pointing to the correct example.de keys, then no they can't mess with the data. The problem is that .de can also point to their own fabricated keys and their own nameservers for example.de and thus "take it over". They can even query your own example.de servers to mirror all the data but the ones they want to change.

So... Yes, .de can take over example.de and there isn't much to do about it unless you've convinced the clients out there to use example.de's DNSKEY itself as a trust-anchor. Which I suspect some enterprise environments might do (trust their companies key so they don't have to require the upstream to be stable). But generally no one will do this as it's not scalable to maintain a bunch of trust anchors.

As for your grandparent (the root, in your example), in order for them to mess with a grandchild they'd have to take over the parent and publish new keys for them as well. So the root is equally as powerful and can take over everything underneath it, but they must do so by taking over all the children not just the grandchildren or the grandgrandchildren.

share|improve this answer
    
I knew most of this. The important part of your answer, though, was the third paragraph: the grandparent really would have to take a child zone including all grandparents to modify one grandparent - which in my opinion is at least impractical to do quickly for large zones. Thanks! –  jroith Feb 5 '11 at 17:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.