Domain Name System Security Extension is a specification for securing certain kinds of information provided by Domain Name System

learn more… | top users | synonyms

3
votes
2answers
35 views

Use DNSSEC for secure connections

From my understanding DNSSEC allows me to create a public key and sign my DNS records. There appears to be multiple ways to have a certificate record (such as DANE see ...
9
votes
1answer
61 views

Can I reasonably use SHA-256 in a DNSSEC deployment?

I know that RFC 5702 documents the use of SHA-2 in DNSSEC, and that RFC 6944 defines RSA/SHA-256 as "recommended to implement." What I'm not aware of is just how widely-implemented SHA-256 is in ...
1
vote
0answers
21 views

How to DNSSEC Sign Bind9 Reverse Zone

I'm using bind9 and dnssec-keygen/dnssec-signzone. I've had no problem signing my forward zones however I cannot seem to find any documentation on signing reverse zones. What is the process for this?
0
votes
1answer
28 views

Effects of publishing DNSSEC DS records without signing public zone?

We at example.com are being pressured to implement DNSSEC by a sub-division of our organisation: security.example.com. Our current name servers ns1.example.com and ns2.example.com are unsigned, ...
2
votes
1answer
40 views

DNSSEC auto signing and file handling

I would like to know how files are handled in a auto-dnssec environment. My current setup (non-DNSSEC) places the zones files in /var/named/data. These files are then read by the bind server. If I ...
0
votes
1answer
73 views

BIND9 DNSSEC: should I care about occasional “insecure” log messages

A small number of my forwarded DNS queries cause BIND 9 to log messages such as: 184.in-addr.arpa SOA: got insecure response; parent indicates it should be secure validating @0x7f93140c0870: ...
0
votes
0answers
15 views

Windows Server 2008 R2 DNSSEC

After reading about DNSSEC realization in Windows Server 2008 R2 it seems to me that it adds extra complexity without being fully secure anyway (I do understand that more security is alway means more ...
0
votes
0answers
61 views

caching nameserver complains dumping master file: tmp-4H4fMHn0WI: open: permission denied

This is a Fedora 19 server acting as the name server (among other things) for a small network. Bind is working just fine as a caching name server for this small network. In case it matters, the ...
3
votes
1answer
123 views

Can't resolve website using Google's public dns

I can't seem to be able access my site: yippie.nl, using Google's public DNS 8.8.8.8. Other DNS's work fine. Could this be due to DNSKEY? Cause Route53 doesn't provide it. ...
2
votes
1answer
68 views

DNSSEC and IPSec DNS Server and DNS Client Configuration

I'm about to deploy DNSSEC for some of my domains and as I was getting ready I did some reading on the subject. I came across some Microsoft Technet articles talking about Name Resolution Policy Table ...
1
vote
1answer
135 views

Using DNSSEC with GoDaddy

This is my setup Domain: nginx-repo[.]com (Registered at GoDaddy) Nameserver: A DigitalOcean VM running BIND on Debian 7 I created a zone for the above mentioned domain on my VM then used ...
0
votes
2answers
98 views

dnssec zonesigner ignoring out-of-zone data

I am trying to configure DNSSec with BIND9 on CentOS 6.4 running DirectAdmin control panel. I am using this tutorial to make it work: https://www.dnssec-tools.org/wiki/index.php/Zonesigner But I ...
1
vote
1answer
141 views

DNS architecture sanity check

I'm designing DNS service for a network and had a few architecture questions. The O'Reilly/ Cricket Liu DNS book and the NIST DNS security guide don't address these questions except in a very general ...
0
votes
1answer
29 views

DNSSEC key information for Bind 9

Is there a tool which allows me to view the parameters of an existing private/public key used for DNSSEC in Bind 9? I've been unable to determine simple things such as the expiration date, the ...
1
vote
1answer
95 views

Submit DS record to parent zone in DNS

I have setup DNSSEC for my domain shabdiznet.com and checked it at http://dnssec-debugger.verisignlabs.com/shabdiznet.com the only problem is No DS records found for shabdiznet.com in the com ...
1
vote
1answer
266 views

What could this extra 50ms latency be on my unbound DNS resolving server (Fedora)?

I have a discrepancy in query latency. It's not a problem, it's just strange enough to worry me. Client machine (Fedora 18) runs unbound-1.4.19-1.fc18.x86_64. Server machine (Debian 7 testing) runs ...
0
votes
1answer
98 views

bind is not validating dnssec

Strange. My bind is not validating dnssec even though I configured it to. Version according to named -V is BIND 9.8.2rc1-RedHat-9.8.2-0.10.rc1.el6_3.2 which has a built-in DLV key. Under options in ...
1
vote
1answer
80 views

DNSSEC - How many DS records are ordinary?

I thought that I need two DS records to deposit at my domain registrar. But one big dns provider just gave me one DS record. Verisign DNSSEC debugger says, everything is correct. But I am confused, ...
0
votes
1answer
68 views

Should DNSSEC validation be done in the recursive DNS server or in client software?

As the title says. The design of DNSSEC and its implementation in Bind (and things like Unbound) quite clearly allow for either use. They can optionally do DNSSEC validation, returning SERVFAIL if ...
4
votes
1answer
89 views

What TLDs should I use for my NS records for redundancy? (DNSSEC support required)

Question As a general practice, is it a good idea to use multiple TLDs for the name servers? How should I choose between which TLD would be a good candidate for being the root server for my NS ...
1
vote
0answers
176 views

How can I disable DNSSC for Google Apps (GMail) MX records on my authoritative domains?

I'm running a BIND Master / Slave setup with DNSSEC, but some of my domains use Google Apps for e-mail services. Google doesn't support DNSSEC and BIND doesn't like it at all. Log output: Sep 6 ...
1
vote
0answers
105 views

OARC's DNSSEC validating resolvers validate all my records but A records

I have DNS set up with powerdns. It serves my DNS pretty well, and it AXFRs to other slaves. The slaves haven't yet updated to the most recent records, but that doesn't affect the validation, it would ...
5
votes
2answers
571 views

What are acceptable key lengths for DNSSEC KSK/ZSK?

I've been tasked to look into implementing DNSSEC on our name servers. While the technical side of this (generate keys, sign zones, prepare rollovers) are relatively straightforward, I've run into a ...
3
votes
1answer
914 views

Basic DNSSEC configuration under BIND 9.7?

Could anybody provide a step-by-step procedure to set up DNSSEC under BIND 9.7? I think the version is relevant because it is supposed to make life easier. In fact, there is a document published by ...
1
vote
1answer
216 views

Inline signing with bind 9.9 and NSEC3

Since version 9.9, Bind supports inline signing, but I don't find any information on how to make it working with NSEC3. I cannot add NSEC3PARAM RR with nsupdate : I think it's normal because of inline ...
2
votes
1answer
92 views

Failing back from DNSSec to regular DNS

A disaster recovery plan has been proposed in a client's company that would fail back from DNSSec to regular DNS in the event of 1) A major site outage requiring the change of many DNS records 2) ...
2
votes
1answer
90 views

enable DNSSEC on workstation

our office servers offer DNSSEC. I've tested this with dig. how can i use DNSSEC with my RHEL6 workstation? (there is no bind on it...) is it possible to add trusted keys to the workstation (i.e. in ...
1
vote
1answer
124 views

DNSSEC NSEC3 salt length

Is there any recommendation for salt length in the NSEC3 records ? Does longer salt means better security, and do longer salt affect performance of (authoritative) servers ? DNSSEC operational ...
4
votes
1answer
595 views

DNSSEC NSEC3 opt-out

Can someone please explain, in simple language, the meaning of opt-out flag in the NSEC3 RR. I did read RFC 5155 and understand nothing.
2
votes
1answer
504 views

enable large DNS queries on Microsoft 2008 R2 DNS server

When I run the Network analyzer at http://netalyzr.icsi.berkeley.edu/ it reports: The resolver at could not process the following tested types: Medium (~1300B) TXT records Large (~3000B) TXT ...
4
votes
2answers
184 views

Do I need to renew the keys which I deposited at my domain provider?

I have set up some domains with dnssec. I generated the keys and signed the zones with zonesigner from dnssec-tools. I know that I must resign the zones within 30 days. But what's up with the keys ...
4
votes
1answer
738 views

Debian DNSSEC - howto secure a domain?

I have a beginner question about DNSSEC. I have much experience with TLS and cryptography-stuff and would like to try out this new technology. I have googled very much about this but I haven't found ...
2
votes
1answer
2k views

nsupdate, getting BADKEY error

I'm trying to update a name using nsupdate executed from within the name server itself but I receive the error message ; TSIG error with server: tsig indicates error. I created a key with ...
1
vote
1answer
157 views

Pushing DNSSEC updates with offline keys

In a non-professional capacity, I look after the DNS of some 18 domains: mostly personal/vanity domains for immediate family. The whole shebang is outsourced to an inexpensive managed hosting ...
1
vote
1answer
68 views

My nameservers do not provide DNSSEC information with their answers- problem?

Some of our users have reported having issues accessing our website ("no response"). Suspecting a DNS issue we have performed some online tests that return only this warning: Your nameservers do not ...
0
votes
1answer
61 views

Could a DNSSEC at level n manipulate a zone at level n+2?

With some people wondering how DNSSEC could affect global censorship, I'd like to know if DNSSEC could protect a zone from being partially modified by a grandparent zone. (The point of this question ...
1
vote
1answer
174 views

DNSSEC - First Signature

I'm testing DNSSEC with Bind 9.7.2-P2. I have a question regarding the first signature created over a zone that already exists. I'm using dynamic DNS. I create the first two keys: one KSK and one ...
0
votes
1answer
86 views

DNSSEC - Recommended parameters

Does anybody know which could be the recommended values for RRSIG validity period and resign interval? Regards
1
vote
1answer
67 views

What DNSSec implementations are available, and have they been checked for padding Cryptographic Oracle vulnerabilities?

A cryptographic Oracle is where one can deduce the private key when a error condition is created. Considering the recent ASP.NET padding Oracle exploit, can anyone tell me if the DNSSec ...
1
vote
1answer
113 views

DNSSEC - DNSKEY RRSIG not updated

Does anybody know why the DNSKEY RRsigs are not re-signed with dynamic update?? Regards
1
vote
1answer
57 views

DNSSEC - Jitter default value

does anybody know which is the default value for jitter when signing a zone?? Regards
0
votes
2answers
137 views

DNSSEC - Dynamic Update

I'm testing key rollover with Dynamic Update. I'm using Bind 9.7.1-P2. When I change the key dates with the script dnssec-settime, named doesn´t update automatically the zone file unless I reload the ...
0
votes
1answer
74 views

How long it takes to start Bind?

I'm testing DNSSEC and I need to obtain the time in miliseconds it takes to start Bind now that I have signed zones. I don't know if this would be the right way to do it: time svcadm enable ...
3
votes
1answer
2k views

Adding DS record to parent in DNS

I am trying to set up DNSSEC for my domains. Everything seems to work but I get the following error: DNSKEY found at child, but no DS was found at parent. Check for DS records in parent zone ...
0
votes
2answers
1k views

DNSSEC - Ad Flag not activated

I have some doubts regarding DNSSEC. I have one server acting as an Authoritative Name Server and another one as a Cache/Resolver. I'm using Bind 9.7.1-P2 and these are my configuration files: ...
3
votes
3answers
278 views

DNSSEC + Bind : dnskey invalidated by tld

I'm trying to enable DNSSEC on my authoritative dns Bind machine. So far I've done the following Tutorial : Generate the KSK and ZSK Keys : dnssec-keygen -a RSASHA1 -b 1024 -n ZONE zonename ...
1
vote
1answer
2k views

Querying and verifying dnssec

I hear http://www.isoc.org/ has Domain Name System Security Extensions on its DNS records. How do I see and verify the DNS using the tool dig?
0
votes
5answers
194 views

DNSSEC - What doesn't it cover?

I'm currently revising for an exam to do with DNS/DNSSEC. While I know DNSSEC provides various security enhancements for DNS, I would like to dive a bit deeper(for my own thirst for knowledge!) and ...
5
votes
3answers
759 views

windows 2003 DNS server and DNS SEC

i have almost out-of-the-box windows 2003 server which is also domain name server for some users. should i be worried of 5th of may's deployment of dnssec on root name servers ? i have already run: ...
6
votes
3answers
989 views

What are the effects of the L root server now publishing DURZ?

I'm curious what the actual effects of the L root server publishing DURZ today will be. On the nanog mailing list, someone said it's important to evaluate the systemic effects of root name servers ...