Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm about to deploy DNSSEC for some of my domains and as I was getting ready I did some reading on the subject. I came across some Microsoft Technet articles talking about Name Resolution Policy Table which allows one to configure Windows DNS clients to use IPSec when communicating with the DNS server to provide integrity and (optionally) authentication.

This seems like a pretty good idea from where I am sitting but alas the NRPT is a Windows only thing. Is there an equivalent in the Linux / OpenBSD world? Having both DNSSEC and IPSec in combination would seem to be the perfect solution for security concious server admins.

share|improve this question
up vote 1 down vote accepted

This whole NRPT thing sounds like a way to bring DNSSEC somewhat in line with DNSCurve, except that instead of having a single standard and spec like it is the case with DNSCurve itself, they're simply throwing up a bunch of unrelated ones together into a big administration and configuration mess.

Deploying DNSSEC for recursive and authoritative servers are two completely different tasks.

What exactly are you trying to accomplish? In the Linux and BSD world, if you simply want to ensure that DNSSEC verification/validation is taking place, best way to go about it is to run your own local recursive or caching resolver. For some details of how it's done, take a look at the recent changes that were made to the upcoming FreeBSD 10, where they've introduced unbound to base tree, which, when used correctly (e.g. if it's set as the only available resolver), is not supposed to resolve any domain names which have DNSSEC enabled, but have records that are not signed correctly, but which were supposed to have been signed.

As far as authoritative servers go, if you want some extra security and privacy, your best bet is to run DNSCurve as a front-end, and possibly still have DNSSEC in the backend, if needed.

I guess for recursive DNS, you'd be doing exactly the same thing, but the other way around: maybe configure a local unbound to be a caching/verification resolver, which would issue all of its queries through a local DNSCurve-aware recursive resolver, but never otherwise.

However, in both of the above examples, I think you're pretty much stepping into an uncharted territory.

share|improve this answer
Awesome answer. Thanks. I'll read up on DNSCurve, I've heard of it but never really did much reading on it. – Cromulent Dec 21 '13 at 13:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.