Domain Name System Security Extension is a specification for securing certain kinds of information provided by Domain Name System

learn more… | top users | synonyms

0
votes
0answers
15 views

Configuring bind with Windows DNS

I am trying to configure Bind DNS Server(version 9.8.0) as DNSSec validation recursive server for Windows Server 2008 DNS Server as server 2008 does'nt support RSA-SHA-256 Trust anchors like server ...
2
votes
2answers
53 views

What kinds of security vulnerabilities does providing DNSSEC expose?

I was thinking about signing my DNS zone with DNSSEC. My zone, the registrar and my DNS server (BIND9) all support DNSSEC. The only one who doesn't support DNSSEC is my secondary nameserver provider ...
0
votes
0answers
25 views

DNS - Making a subdomain of a CNAME

I have a zonefile like this: a.example.com CNAME xyz.example.com xyz.example.com NS ... Is it fully legit to now make subdomains of the CNAME: that is, something like www.a.example.com? Will ...
0
votes
1answer
26 views

DNSsec error in Bind9.10 following update of freebsd10.1

My DNSsec began to fail following a ports update. I have reinstalled Bind on both master and slave but the error still persist. 35 ;; WE HAVE MATERIAL, WE NOW DO VALIDATION 36 ;; VERIFYING A RRset ...
1
vote
1answer
31 views

My resolver doesnt cache the DS RR sent with NS RR

I noticed a strange behaviour on my security-aware resolver. When resolving a secured domain name, the resolver receives DS RRset along with NS RRset. But when it processes to the validation of the ...
1
vote
0answers
20 views

Recommendations for DNSSEC key metadata

In order to implement auto-dnssec maintain in the 9.7+ versions of BIND, one adds dates to the keys as metadata. After a lot of reading, I've come up with the following and hope that someone can ...
0
votes
1answer
26 views

using DNSSEC lookaside because registrar cannot inject DS records

I love my registrar (whom I will not name); but they are currently only able to sign and post my KSK DS records for .com and .net and those are only sign'able by email to "support@mumble.registrar" ...
2
votes
2answers
54 views

Does DNSSec NSEC3 require support from the Registrar, DNS Server or both?

I'm interested in getting NSEC3 support for my domain getvalid.com, so that I can prevent name traversal. DYN doesn't seem to support NSEC3, and it's clear that BIND and the DNS server require the ...
2
votes
2answers
63 views

What are some of the hacks that DNSsec is intended to prevent

I know that the overall purpose of DNSsec is to prevent spoofing your DNS record. But what are some of the actual processes/routines that are used that DNSsec actively prevents?
0
votes
0answers
35 views

How do I use dnssec with wildcard/subdomains?

I have mydomain.com secured via dnssec. Now I'm trying the url sub.mydomain.com according to this page everything is fine. According to dnssec-validator my subdomain isn't dnssec. Using ...
1
vote
1answer
51 views

verisign error -> Query to DNSKEY timed out or failed

I am trying to find the origin of an error I cannot get rid of on the verisign dnssec debugger Verisign debugger Dig queries the server just fine dig ex-mailer.com ANY @108.61.190.64 All of my ...
0
votes
0answers
58 views

issues with dnssec master/slave configuration on freebsd

I am trying to configure DNSSEC as a master/slave. Following signing the zone and uploading the DS record to my provider, I am able to see what appears to be the proper output from dnssec-verify ...
0
votes
0answers
36 views

issues with dnssec master/slave configuration

I am trying to configure DNSSEC as a master/slave. Following signing the zone and uploading the DS record to my provider, I am able to see what appears to be the proper output from dnssec-verify ...
1
vote
1answer
457 views

bind9 configure forward zone for local domain without DNSSEC for this zone only

I have a working DNS server for local domain mydomain.local. I am trying to configure bind9 to work in default configuration, except for this zone, for which I want to forward queries to local DNS ...
-4
votes
1answer
86 views

How do I use dnssec with nginx? [closed]

From my understanding DANE can be used to secure websites (using http) without being signed by a certificant vendor. I follow the instructions on this page although I didn't use NSEC3RSASHA1 as the ...
1
vote
0answers
143 views

Understanding (and partially disabling?) DNSSEC for an internal domain

I am setting up a new DNS infrastructure for our internal HPC cluster environment. This involves providing a migration path from our existing DNS authorities and domains. For sake of example, let's ...
0
votes
1answer
110 views

dnssec-signzone error 'not at top of zone' for a hosted domain

$TTL 86400 $ORIGIN yoda.domain2.com. @ 1D IN SOA yoda.domain2.com. admin.domain.com. ( 2015021601 ; Serial yyyymmddnn 3h ; ...
0
votes
0answers
16 views

What length is a given ZSK/KSK in dnssec

I have a DNSSEC signed zone, but don't remember which length the KSK and ZSK i generated have. Is there an easy/straight-forward way to find the length of those keys?
1
vote
0answers
173 views

How Do I get unbound to only use DNSSEC?

I have a pfsense box, that I am in the process of configuring for the first time I would like to use DNSSEC. I used this site to check my DNSSEC status. When I go to this site I am told that my ...
0
votes
1answer
46 views

Is it required to keep DNSSEC zone fresh?

I've found the following guide on how to setup DNSSEC with NSD DNS server and ldns utilities: https://www.digitalocean.com/community/tutorials/how-to-set-up-dnssec-on-an-nsd-nameserver-on-ubuntu-14-04 ...
0
votes
1answer
66 views

DNSSEC key-file not found

This is actually a follow-up on my previous question (my problem was solved) it can be found here: DNSSEC sign-zone results in fatal failure However, I still want to use dnssec-signzone when creating ...
1
vote
1answer
268 views

DNSSEC sign-zone results in fatal failure

I have a working DNS in a VM-env for testing and learning purposes. It's a complete server from root-domain and a couple of subdomains. I've added dnssec-enable yes; into named.conf, and also ...
1
vote
0answers
90 views

No RRSIGs found

I had a dnssec expiration and since redoing everything, I get the following error No RRSIGs found from verisign debugging These are the exact steps I use to produce the key and signatures. What ...
0
votes
0answers
55 views

setting up DANE fails, error with “could not get cert chain from ssl”

I successfully setup DNSSEC and enabled it on my domain. I'd love to make use of my DANE. I created a standard self signed certificate openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem ...
-2
votes
2answers
79 views

How do I secure a zone with dlv.isc.org's DLV service? [closed]

I'm setting up domain-lookaside validation. I think I got mostly everything correct. I followed the directions here: https://dlv.isc.org/about/using. I registered my domain and uploaded the key ...
0
votes
0answers
21 views

DNSSEC Which key do I need to provide to my domain registrar?

Relating to question Can I reasonably use SHA-256 in a DNSSEC deployment? dnssec-keygen -r /dev/random -a RSASHA256 -b 4096 -3 -f KSK example.com dnssec-keygen -r /dev/urandom -a RSASHA256 -b 1024 -3 ...
0
votes
1answer
65 views

DNSSEC chain of trust

My test environment details are as follows :- I have fake-root server "172.16.93.193" DNS resolver "172.16.93.101" DNS server "172.16.96.93" I have already configured my resolver and it working ...
2
votes
1answer
82 views

DNSSEC key rollover guidelines

I've started playing with DNSSEC on my personal domain and I'm using OpenDNSSEC to perform signing and key maintenance; I only have a static zone, so OpenDNSSEC is an easy fit. Just to toy with ...
0
votes
0answers
90 views

“dnssec-signzone: fatal: failed loading zone from '–o': file not found”

I am new to DNSSEc and and facing some issues while doing dnssec-sign "dnssec-signzone: fatal: failed loading zone from '–o': file not found" . Please let me know how to resolve this issue . (OS - ...
2
votes
0answers
75 views

Managing multiple equal zones with DNSSEC

I run an authoritative name server (BIND), and I have a few dozens domain with identical zone files, i.e. they all use /etc/bind/db.default3. I’m considering deploying DNSSEC on my server, but so far ...
0
votes
1answer
161 views

Website cannot be accessed with google DNS because of unsigned DNS

I get this error: Inconsistent security for stakeholdergame.com - DS found at parent, but no DNSKEY found at child. On http://dnscheck.pingdom.com/?domain=stakeholdergame.com People can't access ...
3
votes
2answers
535 views

Is it possible to create DANE TLSA records when the DNS server doesn't support it?

I'd like to set up DANE for the domain which handles my email. My domain is registered at OVH, and I'm using their anycast DNS servers. They do support DNSSEC, but not TLSA records. Is there a ...
3
votes
2answers
275 views

Use DNSSEC for secure connections

From my understanding DNSSEC allows me to create a public key and sign my DNS records. There appears to be multiple ways to have a certificate record (such as DANE see ...
9
votes
1answer
149 views

Can I reasonably use SHA-256 in a DNSSEC deployment?

I know that RFC 5702 documents the use of SHA-2 in DNSSEC, and that RFC 6944 defines RSA/SHA-256 as "recommended to implement." What I'm not aware of is just how widely-implemented SHA-256 is in ...
1
vote
1answer
263 views

How to DNSSEC Sign Bind9 Reverse Zone

I'm using bind9 and dnssec-keygen/dnssec-signzone. I've had no problem signing my forward zones however I cannot seem to find any documentation on signing reverse zones. What is the process for this?
1
vote
1answer
174 views

Effects of publishing DNSSEC DS records without signing public zone?

We at example.com are being pressured to implement DNSSEC by a sub-division of our organisation: security.example.com. Our current name servers ns1.example.com and ns2.example.com are unsigned, ...
2
votes
2answers
416 views

DNSSEC auto signing and file handling

I would like to know how files are handled in a auto-dnssec environment. My current setup (non-DNSSEC) places the zones files in /var/named/data. These files are then read by the bind server. If I ...
0
votes
1answer
2k views

BIND9 DNSSEC: should I care about occasional “insecure” log messages

A small number of my forwarded DNS queries cause BIND 9 to log messages such as: 184.in-addr.arpa SOA: got insecure response; parent indicates it should be secure validating @0x7f93140c0870: ...
4
votes
1answer
173 views

Do I need DNSSEC?

After reading about DNSSEC realization in Windows Server 2008 R2 it seems to me that it adds extra complexity without being fully secure anyway (I do understand that more security is always means more ...
4
votes
1answer
2k views

Can't resolve website using Google's public dns

I can't seem to be able access my site: yippie.nl, using Google's public DNS 8.8.8.8. Other DNS's work fine. Could this be due to DNSKEY? Cause Route53 doesn't provide it. ...
2
votes
1answer
424 views

DNSSEC and IPSec DNS Server and DNS Client Configuration

I'm about to deploy DNSSEC for some of my domains and as I was getting ready I did some reading on the subject. I came across some Microsoft Technet articles talking about Name Resolution Policy Table ...
0
votes
1answer
669 views

Using DNSSEC with GoDaddy

This is my setup Domain: nginx-repo[.]com (Registered at GoDaddy) Nameserver: A DigitalOcean VM running BIND on Debian 7 I created a zone for the above mentioned domain on my VM then used ...
1
vote
2answers
347 views

dnssec zonesigner ignoring out-of-zone data

I am trying to configure DNSSec with BIND9 on CentOS 6.4 running DirectAdmin control panel. I am using this tutorial to make it work: https://www.dnssec-tools.org/wiki/index.php/Zonesigner But I ...
1
vote
1answer
475 views

DNS architecture sanity check

I'm designing DNS service for a network and had a few architecture questions. The O'Reilly/ Cricket Liu DNS book and the NIST DNS security guide don't address these questions except in a very general ...
0
votes
1answer
86 views

DNSSEC key information for Bind 9

Is there a tool which allows me to view the parameters of an existing private/public key used for DNSSEC in Bind 9? I've been unable to determine simple things such as the expiration date, the ...
1
vote
1answer
527 views

Submit DS record to parent zone in DNS

I have setup DNSSEC for my domain shabdiznet.com and checked it at http://dnssec-debugger.verisignlabs.com/shabdiznet.com the only problem is No DS records found for shabdiznet.com in the com ...
1
vote
1answer
483 views

What could this extra 50ms latency be on my unbound DNS resolving server (Fedora)?

I have a discrepancy in query latency. It's not a problem, it's just strange enough to worry me. Client machine (Fedora 18) runs unbound-1.4.19-1.fc18.x86_64. Server machine (Debian 7 testing) runs ...
2
votes
2answers
303 views

bind is not validating dnssec

Strange. My bind is not validating dnssec even though I configured it to. Version according to named -V is BIND 9.8.2rc1-RedHat-9.8.2-0.10.rc1.el6_3.2 which has a built-in DLV key. Under options in ...
1
vote
1answer
151 views

DNSSEC - How many DS records are ordinary?

I thought that I need two DS records to deposit at my domain registrar. But one big dns provider just gave me one DS record. Verisign DNSSEC debugger says, everything is correct. But I am confused, ...
0
votes
1answer
152 views

Should DNSSEC validation be done in the recursive DNS server or in client software?

As the title says. The design of DNSSEC and its implementation in Bind (and things like Unbound) quite clearly allow for either use. They can optionally do DNSSEC validation, returning SERVFAIL if ...