Domain Name System Security Extension is a specification for securing certain kinds of information provided by Domain Name System

learn more… | top users | synonyms

0
votes
0answers
29 views

dig not giving AD-bit when dnssec is configured

I am working on this Deterlab exercise and I run into some problems when adding DNSSEC to Bind. The server runs BIND 9.7.0-P1. The configurations I have done is the following: Signed zone for ...
2
votes
0answers
40 views

failed loading zone from 'myzone.local.zone': no ttl

I run the following command for dnssec on debian 8. But I get error: # dnssec-signzone -A -3 $(head -c 1000 /dev/random | sha1sum | cut -b 1-16) -N INCREMENT -o myzone.local -t myzone.local.zone ...
1
vote
0answers
32 views

DNSSEC on .cloud TLD [closed]

we would like to use DNSSEC on .cloud TLD domain, we plan to use the domain for distribution of PKI certificates and OpenSSH certificates, so end-to-end DNSSEC is a must have for us. I did some ...
2
votes
1answer
45 views

Error using dnssec-signzone in chroot'd bind 9.8 when a zone file includes other files

Using bind 9.8.2 on RHEL 6.5, running chroot'd. I have a zone file that includes other files (it's a zone with a large number of servers in different datacenters, and there's one included file per ...
7
votes
5answers
387 views

No IPv6 & DNSSEC support on cc-TLD? (practical implications)

I'm needing to register some domains that have country code domain extensions, but noticed that those TLDs do not officially support (A) IPv6 or (B) DNSSEC... What limitations or pitfalls should I ...
1
vote
2answers
102 views

Remove DS Records from Parent Zone

We transferred a .se domain to GoDaddy from a small Swedish registrar. It turns out the original domain has DNSSEC setup and the DS records were never removed from the parent zone when it was ...
2
votes
2answers
70 views

Outsourcing Recursive DNS in a Windows Domain Environment

We've been considering utilizing a third-party recursive DNS provider like OpenDNS (or anyone) to provide a layer of antiphishing and DNSSEC validation (without having to implement those features ...
0
votes
0answers
43 views

DNSSEC Key Rollover

I trie to get the auto key rollover to get to work on my testsystem: /etc/bind/named.conf.options : options { directory "/var/cache/bind"; key-directory "/etc/bind/keys"; ...
1
vote
1answer
46 views

Using DNSSEC with private TLD

I'm playing with DNSSEC for my domain, my DNS server is dual homed (with suitable limits on what can be queried on the public interface) and covers both my public domain, but also a private top level ...
0
votes
0answers
38 views

Bind9.10 inline signing 'loadkeys' failing

I have using the exact same rndc method to load inline signing keys as what worked yesterday, but today the same steps are failing? a stuck key? # rndc flush # rndc reconfig # rndc addzone domain.com ...
0
votes
1answer
74 views

Which upstream servers is unbound using? [closed]

In order to have local DNSSEC validation, I set up a Raspberry Pi (having a static IP) with Raspian Jessie and unbound to offer a DNS server to my LAN. After I looked up some tutorials and howtos, I ...
0
votes
1answer
30 views

bind9.10 dnssec inline signing failing

I am pretty sure the ultimate error is this: [\u@r2d2:/home/ex-mailer-domains/domain.com] # dig domain.com +dnssec @8.8.8.8 ; <<>> DiG 9.10.3 <<>> domain.com +dnssec @8.8.8.8 ...
0
votes
1answer
94 views

dnssec remove keys from zone

is there a way to remove all dnssec related stuff from a zone on a running bind server? I configured bind like like here described. If i use rndc signing -clear all domain.tld nothng happens to the ...
0
votes
1answer
44 views

dnssec-keygen key default validation / expiration time

What is the default expire time/period for a key, generated by dnssec-keygen: If i execute: dnssec-keygen -a RSASHA256 -b 2048 -f KSK mydomain.com I get 2 files: (Kmydomain.com.+008+21346.key) ; ...
0
votes
1answer
32 views

Does TSIG and DNSSEC provide encryption of entire DNS packet?

it says TSIG and DNSSEC provide authentication. Does it mean whole DNS traffic would be encrypted so if I do packet capturing I would not be able to parse anything ? Or DNS data is still plain text ...
1
vote
0answers
32 views

opendnssec and DelegationSignerSubmitCommand

I have a zone myzone.fr on my DNS running BIND and opendnssec. The new DS need to be send to the registry as shown in the log of ods-enforcerd: ods-enforcerd: WARNING: New KSK has reached the ...
2
votes
2answers
78 views

Where does my ds record originate from?

The domain dwc-amsterdam.com was acquired on hosting company A (hostA) which supports DNSSEC. It was then transferred to hosting company B (hostB) which doesnot offer DNSSEC. After detecting certain ...
0
votes
0answers
614 views

DKIM-verification fails because of “insecure key”

I have my Debian (7.9 "wheezy") E-Mail-server (Postfix 2.9.6-2) setup to sign and verify DKIM signatures in e-mail messages using OpenDKIM (version 2.6.8-4). When I send myself an e-mail from my ...
0
votes
0answers
28 views

Can not make rollerd sign zone DNSSEC

I am trying to setup a DNSSEC-server with BIND 9.8.1. I followed the tutorial at https://www.howtoforge.com/configuring-dnssec-on-bind9-9.7.3-on-debian-squeeze-ubuntu-11.10 Everything seems to work ...
3
votes
1answer
193 views

dnsmasq returns (false) “bogus” result for DNSSEC validation

I'm running a local Debian 8.1 installation with a DNSSEC-validating DNS-Resolver called dnsmasq (version 2.72-3+deb8u1). I set it up to return a SERVFAIL if it isn't able to validate a ...
0
votes
1answer
35 views

DNSSEC without registrar

The real title: How to use DS records without registrar help I'm trying to stay loyal to my registrar, I have over 100 domains with them. Their "Advanced DNS" is pretty lacking(just A, TXT, CNAME and ...
1
vote
0answers
33 views

BIND DNS to DNSSEC Converting Forwarder

I have an internal only DNS server running on BIND 9.8.4 on Debian, this recurses and caches all queries other than internal domain (ourdomain.lan) to OpenDNS. What I am hoping to do is to have all ...
1
vote
1answer
2k views

BIND server has tons of “no valid RRSIG” errors

I have a forward-only BIND9 server running on the LAN and it logs hundreds of errors per day like: Aug 29 18:38:29 nuc named[850]: error (no valid RRSIG) resolving 'ubuntu.com/DS/IN': 75.75.75.75#53 ...
0
votes
0answers
89 views

Configuring bind with Windows DNS

I am trying to configure Bind DNS Server(version 9.8.0) as DNSSec validation recursive server for Windows Server 2008 DNS Server as server 2008 does'nt support RSA-SHA-256 Trust anchors like server ...
23
votes
3answers
6k views

What kinds of security vulnerabilities does providing DNSSEC expose?

I was planning to sign my DNS zone with DNSSEC. My zone, the registrar and my DNS server (BIND9) all support DNSSEC. The only one who doesn't support DNSSEC is my secondary nameserver provider (namely ...
0
votes
0answers
30 views

DNS - Making a subdomain of a CNAME

I have a zonefile like this: a.example.com CNAME xyz.example.com xyz.example.com NS ... Is it fully legit to now make subdomains of the CNAME: that is, something like www.a.example.com? Will ...
0
votes
1answer
40 views

DNSsec error in Bind9.10 following update of freebsd10.1

My DNSsec began to fail following a ports update. I have reinstalled Bind on both master and slave but the error still persist. 35 ;; WE HAVE MATERIAL, WE NOW DO VALIDATION 36 ;; VERIFYING A RRset ...
1
vote
1answer
43 views

My resolver doesnt cache the DS RR sent with NS RR

I noticed a strange behaviour on my security-aware resolver. When resolving a secured domain name, the resolver receives DS RRset along with NS RRset. But when it processes to the validation of the ...
1
vote
0answers
30 views

Recommendations for DNSSEC key metadata

In order to implement auto-dnssec maintain in the 9.7+ versions of BIND, one adds dates to the keys as metadata. After a lot of reading, I've come up with the following and hope that someone can ...
0
votes
1answer
30 views

using DNSSEC lookaside because registrar cannot inject DS records

I love my registrar (whom I will not name); but they are currently only able to sign and post my KSK DS records for .com and .net and those are only sign'able by email to "support@mumble.registrar" ...
2
votes
2answers
102 views

Does DNSSec NSEC3 require support from the Registrar, DNS Server or both?

I'm interested in getting NSEC3 support for my domain getvalid.com, so that I can prevent name traversal. DYN doesn't seem to support NSEC3, and it's clear that BIND and the DNS server require the ...
2
votes
2answers
98 views

What are some of the hacks that DNSsec is intended to prevent

I know that the overall purpose of DNSsec is to prevent spoofing your DNS record. But what are some of the actual processes/routines that are used that DNSsec actively prevents?
1
vote
1answer
88 views

verisign error -> Query to DNSKEY timed out or failed

I am trying to find the origin of an error I cannot get rid of on the verisign dnssec debugger Verisign debugger Dig queries the server just fine dig ex-mailer.com ANY @108.61.190.64 All of my ...
0
votes
0answers
62 views

issues with dnssec master/slave configuration

I am trying to configure DNSSEC as a master/slave. Following signing the zone and uploading the DS record to my provider, I am able to see what appears to be the proper output from dnssec-verify ...
2
votes
2answers
2k views

bind9 configure forward zone for local domain without DNSSEC for this zone only

I have a working DNS server for local domain mydomain.local. I am trying to configure bind9 to work in default configuration, except for this zone, for which I want to forward queries to local DNS ...
-4
votes
1answer
214 views

How do I use dnssec with nginx? [closed]

From my understanding DANE can be used to secure websites (using http) without being signed by a certificant vendor. I follow the instructions on this page although I didn't use NSEC3RSASHA1 as the ...
1
vote
0answers
520 views

Understanding (and partially disabling?) DNSSEC for an internal domain

I am setting up a new DNS infrastructure for our internal HPC cluster environment. This involves providing a migration path from our existing DNS authorities and domains. For sake of example, let's ...
0
votes
1answer
356 views

dnssec-signzone error 'not at top of zone' for a hosted domain

$TTL 86400 $ORIGIN yoda.domain2.com. @ 1D IN SOA yoda.domain2.com. admin.domain.com. ( 2015021601 ; Serial yyyymmddnn 3h ; ...
1
vote
0answers
335 views

How Do I get unbound to only use DNSSEC?

I have a pfsense box, that I am in the process of configuring for the first time I would like to use DNSSEC. I used this site to check my DNSSEC status. When I go to this site I am told that my ...
0
votes
1answer
73 views

Is it required to keep DNSSEC zone fresh?

I've found the following guide on how to setup DNSSEC with NSD DNS server and ldns utilities: https://www.digitalocean.com/community/tutorials/how-to-set-up-dnssec-on-an-nsd-nameserver-on-ubuntu-14-04 ...
0
votes
1answer
242 views

DNSSEC key-file not found

This is actually a follow-up on my previous question (my problem was solved) it can be found here: DNSSEC sign-zone results in fatal failure However, I still want to use dnssec-signzone when creating ...
1
vote
1answer
748 views

DNSSEC sign-zone results in fatal failure

I have a working DNS in a VM-env for testing and learning purposes. It's a complete server from root-domain and a couple of subdomains. I've added dnssec-enable yes; into named.conf, and also ...
1
vote
0answers
228 views

No RRSIGs found

I had a dnssec expiration and since redoing everything, I get the following error No RRSIGs found from verisign debugging These are the exact steps I use to produce the key and signatures. What ...
-2
votes
2answers
111 views

How do I secure a zone with dlv.isc.org's DLV service? [closed]

I'm setting up domain-lookaside validation. I think I got mostly everything correct. I followed the directions here: https://dlv.isc.org/about/using. I registered my domain and uploaded the key ...
0
votes
1answer
90 views

DNSSEC chain of trust

My test environment details are as follows :- I have fake-root server "172.16.93.193" DNS resolver "172.16.93.101" DNS server "172.16.96.93" I have already configured my resolver and it working ...
3
votes
1answer
143 views

DNSSEC key rollover guidelines

I've started playing with DNSSEC on my personal domain and I'm using OpenDNSSEC to perform signing and key maintenance; I only have a static zone, so OpenDNSSEC is an easy fit. Just to toy with ...
2
votes
0answers
100 views

Managing multiple equal zones with DNSSEC

I run an authoritative name server (BIND), and I have a few dozens domain with identical zone files, i.e. they all use /etc/bind/db.default3. I’m considering deploying DNSSEC on my server, but so far ...
0
votes
1answer
194 views

Website cannot be accessed with google DNS because of unsigned DNS

I get this error: Inconsistent security for stakeholdergame.com - DS found at parent, but no DNSKEY found at child. On http://dnscheck.pingdom.com/?domain=stakeholdergame.com People can't access ...
3
votes
2answers
777 views

Is it possible to create DANE TLSA records when the DNS server doesn't support it?

I'd like to set up DANE for the domain which handles my email. My domain is registered at OVH, and I'm using their anycast DNS servers. They do support DNSSEC, but not TLSA records. Is there a ...
3
votes
2answers
341 views

Use DNSSEC for secure connections

From my understanding DNSSEC allows me to create a public key and sign my DNS records. There appears to be multiple ways to have a certificate record (such as DANE see ...