Domain Name System Security Extension is a specification for securing certain kinds of information provided by Domain Name System
0
votes
0answers
31 views
DNS Strange Error : sometimes lookup work sometimes doesn't
I am running a DNS Server over fedora 11 (64-bit) with bind 9.6
I don't know what is going work but it works in a minute and not in next and then again cycle goes on. Its giving strange behaviour.
I ...
0
votes
0answers
11 views
howto config RRSIG Validity Period Dynamic
there is a default 30day Validity Period for RRSIG in bind,if i want to change this Validity Period how i can do.
dnssec-signzone can do this,but its not suitable to use in dynamic update, is there ...
1
vote
1answer
118 views
What could this extra 50ms latency be on my unbound DNS resolving server (Fedora)?
I have a discrepancy in query latency. It's not a problem, it's just strange enough to worry me.
Client machine (Fedora 18) runs unbound-1.4.19-1.fc18.x86_64.
Server machine (Debian 7 testing) runs ...
0
votes
1answer
49 views
bind is not validating dnssec
Strange. My bind is not validating dnssec even though I configured it to. Version according to named -V is BIND 9.8.2rc1-RedHat-9.8.2-0.10.rc1.el6_3.2 which has a built-in DLV key.
Under options in ...
1
vote
1answer
54 views
DNSSEC - How many DS records are ordinary?
I thought that I need two DS records to deposit at my domain registrar. But one big dns provider just gave me one DS record. Verisign DNSSEC debugger says, everything is correct. But I am confused, ...
0
votes
1answer
58 views
Should DNSSEC validation be done in the recursive DNS server or in client software?
As the title says.
The design of DNSSEC and its implementation in Bind (and things like Unbound) quite clearly allow for either use. They can optionally do DNSSEC validation, returning SERVFAIL if ...
4
votes
1answer
79 views
What TLDs should I use for my NS records for redundancy? (DNSSEC support required)
Question
As a general practice, is it a good idea to use multiple TLDs for the name servers?
How should I choose between which TLD would be a good candidate for being the root server for my NS ...
1
vote
0answers
125 views
How can I disable DNSSC for Google Apps (GMail) MX records on my authoritative domains?
I'm running a BIND Master / Slave setup with DNSSEC, but some of my domains use Google Apps for e-mail services. Google doesn't support DNSSEC and BIND doesn't like it at all.
Log output:
Sep 6 ...
1
vote
0answers
74 views
OARC's DNSSEC validating resolvers validate all my records but A records
I have DNS set up with powerdns. It serves my DNS pretty well, and it AXFRs to other slaves. The slaves haven't yet updated to the most recent records, but that doesn't affect the validation, it would ...
0
votes
0answers
55 views
F5 GTM DNSSEC ZSK id numbers out of sync
My GTMs have been working ok since we setup DNSSEC. We upgraded to 10.2.4 and ran into a problem - no DNSSEC responses at all. I booted back to 10.2.3 and now my ZSK id numbers aren't the same on both ...
4
votes
2answers
279 views
What are acceptable key lengths for DNSSEC KSK/ZSK?
I've been tasked to look into implementing DNSSEC on our name servers. While the technical side of this (generate keys, sign zones, prepare rollovers) are relatively straightforward, I've run into a ...
3
votes
1answer
513 views
Basic DNSSEC configuration under BIND 9.7?
Could anybody provide a step-by-step procedure to set up DNSSEC under BIND 9.7? I think the version is relevant because it is supposed to make life easier. In fact, there is a document published by ...
1
vote
1answer
139 views
Inline signing with bind 9.9 and NSEC3
Since version 9.9, Bind supports inline signing, but I don't find any information on how to make it working with NSEC3. I cannot add NSEC3PARAM RR with nsupdate : I think it's normal because of inline ...
2
votes
1answer
78 views
Failing back from DNSSec to regular DNS
A disaster recovery plan has been proposed in a client's company that would fail back from DNSSec to regular DNS in the event of
1) A major site outage requiring the change of many DNS records
2) ...
2
votes
1answer
77 views
enable DNSSEC on workstation
our office servers offer DNSSEC. I've tested this with dig.
how can i use DNSSEC with my RHEL6 workstation? (there is no bind on it...)
is it possible to add trusted keys to the workstation (i.e. in ...
1
vote
1answer
85 views
DNSSEC NSEC3 salt length
Is there any recommendation for salt length in the NSEC3 records ? Does longer salt means better security, and do longer salt affect performance of (authoritative) servers ?
DNSSEC operational ...
3
votes
1answer
364 views
DNSSEC NSEC3 opt-out
Can someone please explain, in simple language, the meaning of opt-out flag in the NSEC3 RR. I did read RFC 5155 and understand nothing.
2
votes
1answer
358 views
enable large DNS queries on Microsoft 2008 R2 DNS server
When I run the Network analyzer at http://netalyzr.icsi.berkeley.edu/ it reports:
The resolver at could not process the following tested types:
Medium (~1300B) TXT records
Large (~3000B) TXT ...
4
votes
3answers
122 views
Do I need to renew the keys which I deposited at my domain provider?
I have set up some domains with dnssec. I generated the keys and signed the zones with zonesigner from dnssec-tools. I know that I must resign the zones within 30 days. But what's up with the keys ...
4
votes
1answer
513 views
Debian DNSSEC - howto secure a domain?
I have a beginner question about DNSSEC. I have much experience with TLS and cryptography-stuff and would like to try out this new technology. I have googled very much about this but I haven't found ...
2
votes
1answer
972 views
nsupdate, getting BADKEY error
I'm trying to update a name using nsupdate executed from within the name server itself but I receive the error message
; TSIG error with server: tsig indicates error.
I created a key with ...
1
vote
1answer
109 views
Pushing DNSSEC updates with offline keys
In a non-professional capacity, I look after the DNS of some 18 domains: mostly personal/vanity domains for immediate family. The whole shebang is outsourced to an inexpensive managed hosting ...
1
vote
1answer
63 views
My nameservers do not provide DNSSEC information with their answers- problem?
Some of our users have reported having issues accessing our website ("no response"). Suspecting a DNS issue we have performed some online tests that return only this warning:
Your nameservers do not ...
0
votes
1answer
55 views
Could a DNSSEC at level n manipulate a zone at level n+2?
With some people wondering how DNSSEC could affect global censorship, I'd like to know if DNSSEC could protect a zone from being partially modified by a grandparent zone. (The point of this question ...
0
votes
1answer
149 views
DNSSEC - First Signature
I'm testing DNSSEC with Bind 9.7.2-P2. I have a question regarding the first signature created over a zone that already exists. I'm using dynamic DNS.
I create the first two keys: one KSK and one ...
0
votes
1answer
72 views
DNSSEC - Recommended parameters
Does anybody know which could be the recommended values for RRSIG validity period and resign interval?
Regards
1
vote
1answer
64 views
What DNSSec implementations are available, and have they been checked for padding Cryptographic Oracle vulnerabilities?
A cryptographic Oracle is where one can deduce the private key when a error condition is created.
Considering the recent ASP.NET padding Oracle exploit, can anyone tell me if the DNSSec ...
1
vote
1answer
104 views
DNSSEC - DNSKEY RRSIG not updated
Does anybody know why the DNSKEY RRsigs are not re-signed with dynamic update??
Regards
1
vote
1answer
51 views
DNSSEC - Jitter default value
does anybody know which is the default value for jitter when signing a zone??
Regards
0
votes
2answers
133 views
DNSSEC - Dynamic Update
I'm testing key rollover with Dynamic Update. I'm using Bind 9.7.1-P2. When I change the key dates with the script dnssec-settime, named doesn´t update automatically the zone file unless I reload the ...
0
votes
1answer
69 views
How long it takes to start Bind?
I'm testing DNSSEC and I need to obtain the time in miliseconds it takes to start Bind now that I have signed zones. I don't know if this would be the right way to do it:
time svcadm enable ...
2
votes
1answer
1k views
Adding DS record to parent in DNS
I am trying to set up DNSSEC for my domains. Everything seems to work but I get the following error:
DNSKEY found at child, but no DS was found at parent.
Check for DS records in parent zone
...
0
votes
2answers
1k views
DNSSEC - Ad Flag not activated
I have some doubts regarding DNSSEC. I have one server acting as an Authoritative Name Server and another one as a Cache/Resolver. I'm using Bind 9.7.1-P2 and these are my configuration files:
...
3
votes
3answers
249 views
DNSSEC + Bind : dnskey invalidated by tld
I'm trying to enable DNSSEC on my authoritative dns Bind machine. So far I've done the following Tutorial :
Generate the KSK and ZSK Keys :
dnssec-keygen -a RSASHA1 -b 1024 -n ZONE zonename
...
1
vote
1answer
2k views
Querying and verifying dnssec
I hear http://www.isoc.org/ has Domain Name System Security Extensions on its DNS records.
How do I see and verify the DNS using the tool dig?
0
votes
5answers
188 views
DNSSEC - What doesn't it cover?
I'm currently revising for an exam to do with DNS/DNSSEC.
While I know DNSSEC provides various security enhancements for DNS, I would like to dive a bit deeper(for my own thirst for knowledge!) and ...
5
votes
3answers
710 views
windows 2003 DNS server and DNS SEC
i have almost out-of-the-box windows 2003 server which is also domain name server for some users. should i be worried of 5th of may's deployment of dnssec on root name servers ?
i have already run:
...
6
votes
3answers
980 views
What are the effects of the L root server now publishing DURZ?
I'm curious what the actual effects of the L root server publishing DURZ today will be. On the nanog mailing list, someone said it's important to evaluate the systemic effects of root name servers ...
0
votes
1answer
100 views
What strength should I use for my ISC BIND transfer key?
Currently I'm using 128, is this secure enough?
dnssec-keygen -a hmac-md5 -b 128 -n host foobar.com
Also I'm not sure if "host" is the correct value for -n arg. I believe that the last argument ...
0
votes
1answer
421 views
Cannot publish DNSKEY to dlv.isc.org
Trying to get DNSSEC working for zone.
Software: BIND 9.4.2-P2, OS Ubuntu 8.04
Tried to sign zone using ZoneSigner and publish that to dlv.isc.org, but it complains about key missing. Key shows ...
1
vote
2answers
337 views
DNSSEC MITM attacks
What makes DNSSEC immune to a MITM attack?
Why can't I sign a key for example.com and get this to a resolving nameserver or client before they can get it from the real source?
