Domain Name System Security Extension is a specification for securing certain kinds of information provided by Domain Name System

learn more… | top users | synonyms

0
votes
0answers
6 views

DNSSEC Which key do I need to provide to my domain registrar?

Relating to question Can I reasonably use SHA-256 in a DNSSEC deployment? dnssec-keygen -r /dev/random -a RSASHA256 -b 4096 -3 -f KSK example.com dnssec-keygen -r /dev/urandom -a RSASHA256 -b 1024 -3 ...
0
votes
1answer
24 views

DNSSEC chain of trust

My test environment details are as follows :- I have fake-root server "172.16.93.193" DNS resolver "172.16.93.101" DNS server "172.16.96.93" I have already configured my resolver and it working ...
2
votes
1answer
19 views

DNSSEC key rollover guidelines

I've started playing with DNSSEC on my personal domain and I'm using OpenDNSSEC to perform signing and key maintenance; I only have a static zone, so OpenDNSSEC is an easy fit. Just to toy with ...
0
votes
0answers
23 views

“dnssec-signzone: fatal: failed loading zone from '–o': file not found”

I am new to DNSSEc and and facing some issues while doing dnssec-sign "dnssec-signzone: fatal: failed loading zone from '–o': file not found" . Please let me know how to resolve this issue . (OS - ...
1
vote
0answers
29 views

Managing multiple equal zones with DNSSEC

I run an authoritative name server (BIND), and I have a few dozens domain with identical zone files, i.e. they all use /etc/bind/db.default3. I’m considering deploying DNSSEC on my server, but so far ...
0
votes
1answer
79 views

Website cannot be accessed with google DNS because of unsigned DNS

I get this error: Inconsistent security for stakeholdergame.com - DS found at parent, but no DNSKEY found at child. On http://dnscheck.pingdom.com/?domain=stakeholdergame.com People can't access ...
3
votes
2answers
197 views

Is it possible to create DANE TLSA records when the DNS server doesn't support it?

I'd like to set up DANE for the domain which handles my email. My domain is registered at OVH, and I'm using their anycast DNS servers. They do support DNSSEC, but not TLSA records. Is there a ...
3
votes
2answers
125 views

Use DNSSEC for secure connections

From my understanding DNSSEC allows me to create a public key and sign my DNS records. There appears to be multiple ways to have a certificate record (such as DANE see ...
9
votes
1answer
94 views

Can I reasonably use SHA-256 in a DNSSEC deployment?

I know that RFC 5702 documents the use of SHA-2 in DNSSEC, and that RFC 6944 defines RSA/SHA-256 as "recommended to implement." What I'm not aware of is just how widely-implemented SHA-256 is in ...
1
vote
1answer
108 views

How to DNSSEC Sign Bind9 Reverse Zone

I'm using bind9 and dnssec-keygen/dnssec-signzone. I've had no problem signing my forward zones however I cannot seem to find any documentation on signing reverse zones. What is the process for this?
1
vote
1answer
99 views

Effects of publishing DNSSEC DS records without signing public zone?

We at example.com are being pressured to implement DNSSEC by a sub-division of our organisation: security.example.com. Our current name servers ns1.example.com and ns2.example.com are unsigned, ...
2
votes
2answers
117 views

DNSSEC auto signing and file handling

I would like to know how files are handled in a auto-dnssec environment. My current setup (non-DNSSEC) places the zones files in /var/named/data. These files are then read by the bind server. If I ...
0
votes
1answer
430 views

BIND9 DNSSEC: should I care about occasional “insecure” log messages

A small number of my forwarded DNS queries cause BIND 9 to log messages such as: 184.in-addr.arpa SOA: got insecure response; parent indicates it should be secure validating @0x7f93140c0870: ...
4
votes
1answer
68 views

Do I need DNSSEC?

After reading about DNSSEC realization in Windows Server 2008 R2 it seems to me that it adds extra complexity without being fully secure anyway (I do understand that more security is always means more ...
4
votes
1answer
651 views

Can't resolve website using Google's public dns

I can't seem to be able access my site: yippie.nl, using Google's public DNS 8.8.8.8. Other DNS's work fine. Could this be due to DNSKEY? Cause Route53 doesn't provide it. ...
2
votes
1answer
170 views

DNSSEC and IPSec DNS Server and DNS Client Configuration

I'm about to deploy DNSSEC for some of my domains and as I was getting ready I did some reading on the subject. I came across some Microsoft Technet articles talking about Name Resolution Policy Table ...
0
votes
1answer
348 views

Using DNSSEC with GoDaddy

This is my setup Domain: nginx-repo[.]com (Registered at GoDaddy) Nameserver: A DigitalOcean VM running BIND on Debian 7 I created a zone for the above mentioned domain on my VM then used ...
0
votes
2answers
206 views

dnssec zonesigner ignoring out-of-zone data

I am trying to configure DNSSec with BIND9 on CentOS 6.4 running DirectAdmin control panel. I am using this tutorial to make it work: https://www.dnssec-tools.org/wiki/index.php/Zonesigner But I ...
1
vote
1answer
214 views

DNS architecture sanity check

I'm designing DNS service for a network and had a few architecture questions. The O'Reilly/ Cricket Liu DNS book and the NIST DNS security guide don't address these questions except in a very general ...
0
votes
1answer
44 views

DNSSEC key information for Bind 9

Is there a tool which allows me to view the parameters of an existing private/public key used for DNSSEC in Bind 9? I've been unable to determine simple things such as the expiration date, the ...
1
vote
1answer
233 views

Submit DS record to parent zone in DNS

I have setup DNSSEC for my domain shabdiznet.com and checked it at http://dnssec-debugger.verisignlabs.com/shabdiznet.com the only problem is No DS records found for shabdiznet.com in the com ...
1
vote
1answer
345 views

What could this extra 50ms latency be on my unbound DNS resolving server (Fedora)?

I have a discrepancy in query latency. It's not a problem, it's just strange enough to worry me. Client machine (Fedora 18) runs unbound-1.4.19-1.fc18.x86_64. Server machine (Debian 7 testing) runs ...
0
votes
1answer
134 views

bind is not validating dnssec

Strange. My bind is not validating dnssec even though I configured it to. Version according to named -V is BIND 9.8.2rc1-RedHat-9.8.2-0.10.rc1.el6_3.2 which has a built-in DLV key. Under options in ...
1
vote
1answer
108 views

DNSSEC - How many DS records are ordinary?

I thought that I need two DS records to deposit at my domain registrar. But one big dns provider just gave me one DS record. Verisign DNSSEC debugger says, everything is correct. But I am confused, ...
0
votes
1answer
99 views

Should DNSSEC validation be done in the recursive DNS server or in client software?

As the title says. The design of DNSSEC and its implementation in Bind (and things like Unbound) quite clearly allow for either use. They can optionally do DNSSEC validation, returning SERVFAIL if ...
4
votes
1answer
102 views

What TLDs should I use for my NS records for redundancy? (DNSSEC support required)

Question As a general practice, is it a good idea to use multiple TLDs for the name servers? How should I choose between which TLD would be a good candidate for being the root server for my NS ...
2
votes
1answer
219 views

How can I disable DNSSC for Google Apps (GMail) MX records on my authoritative domains?

I'm running a BIND Master / Slave setup with DNSSEC, but some of my domains use Google Apps for e-mail services. Google doesn't support DNSSEC and BIND doesn't like it at all. Log output: Sep 6 ...
1
vote
0answers
121 views

OARC's DNSSEC validating resolvers validate all my records but A records

I have DNS set up with powerdns. It serves my DNS pretty well, and it AXFRs to other slaves. The slaves haven't yet updated to the most recent records, but that doesn't affect the validation, it would ...
5
votes
2answers
733 views

What are acceptable key lengths for DNSSEC KSK/ZSK?

I've been tasked to look into implementing DNSSEC on our name servers. While the technical side of this (generate keys, sign zones, prepare rollovers) are relatively straightforward, I've run into a ...
3
votes
1answer
1k views

Basic DNSSEC configuration under BIND 9.7?

Could anybody provide a step-by-step procedure to set up DNSSEC under BIND 9.7? I think the version is relevant because it is supposed to make life easier. In fact, there is a document published by ...
2
votes
1answer
301 views

Inline signing with bind 9.9 and NSEC3

Since version 9.9, Bind supports inline signing, but I don't find any information on how to make it working with NSEC3. I cannot add NSEC3PARAM RR with nsupdate : I think it's normal because of inline ...
2
votes
1answer
112 views

Failing back from DNSSec to regular DNS

A disaster recovery plan has been proposed in a client's company that would fail back from DNSSec to regular DNS in the event of 1) A major site outage requiring the change of many DNS records 2) ...
2
votes
1answer
96 views

enable DNSSEC on workstation

our office servers offer DNSSEC. I've tested this with dig. how can i use DNSSEC with my RHEL6 workstation? (there is no bind on it...) is it possible to add trusted keys to the workstation (i.e. in ...
1
vote
1answer
153 views

DNSSEC NSEC3 salt length

Is there any recommendation for salt length in the NSEC3 records ? Does longer salt means better security, and do longer salt affect performance of (authoritative) servers ? DNSSEC operational ...
4
votes
1answer
838 views

DNSSEC NSEC3 opt-out

Can someone please explain, in simple language, the meaning of opt-out flag in the NSEC3 RR. I did read RFC 5155 and understand nothing.
2
votes
1answer
585 views

enable large DNS queries on Microsoft 2008 R2 DNS server

When I run the Network analyzer at http://netalyzr.icsi.berkeley.edu/ it reports: The resolver at could not process the following tested types: Medium (~1300B) TXT records Large (~3000B) TXT ...
4
votes
2answers
244 views

Do I need to renew the keys which I deposited at my domain provider?

I have set up some domains with dnssec. I generated the keys and signed the zones with zonesigner from dnssec-tools. I know that I must resign the zones within 30 days. But what's up with the keys ...
5
votes
1answer
896 views

Debian DNSSEC - howto secure a domain?

I have a beginner question about DNSSEC. I have much experience with TLS and cryptography-stuff and would like to try out this new technology. I have googled very much about this but I haven't found ...
3
votes
1answer
3k views

nsupdate, getting BADKEY error

I'm trying to update a name using nsupdate executed from within the name server itself but I receive the error message ; TSIG error with server: tsig indicates error. I created a key with ...
1
vote
1answer
180 views

Pushing DNSSEC updates with offline keys

In a non-professional capacity, I look after the DNS of some 18 domains: mostly personal/vanity domains for immediate family. The whole shebang is outsourced to an inexpensive managed hosting ...
1
vote
1answer
70 views

My nameservers do not provide DNSSEC information with their answers- problem?

Some of our users have reported having issues accessing our website ("no response"). Suspecting a DNS issue we have performed some online tests that return only this warning: Your nameservers do not ...
0
votes
1answer
77 views

Could a DNSSEC at level n manipulate a zone at level n+2?

With some people wondering how DNSSEC could affect global censorship, I'd like to know if DNSSEC could protect a zone from being partially modified by a grandparent zone. (The point of this question ...
1
vote
1answer
189 views

DNSSEC - First Signature

I'm testing DNSSEC with Bind 9.7.2-P2. I have a question regarding the first signature created over a zone that already exists. I'm using dynamic DNS. I create the first two keys: one KSK and one ...
0
votes
1answer
92 views

DNSSEC - Recommended parameters

Does anybody know which could be the recommended values for RRSIG validity period and resign interval? Regards
1
vote
1answer
68 views

What DNSSec implementations are available, and have they been checked for padding Cryptographic Oracle vulnerabilities?

A cryptographic Oracle is where one can deduce the private key when a error condition is created. Considering the recent ASP.NET padding Oracle exploit, can anyone tell me if the DNSSec ...
1
vote
1answer
126 views

DNSSEC - DNSKEY RRSIG not updated

Does anybody know why the DNSKEY RRsigs are not re-signed with dynamic update?? Regards
1
vote
1answer
65 views

DNSSEC - Jitter default value

does anybody know which is the default value for jitter when signing a zone?? Regards
0
votes
2answers
138 views

DNSSEC - Dynamic Update

I'm testing key rollover with Dynamic Update. I'm using Bind 9.7.1-P2. When I change the key dates with the script dnssec-settime, named doesn´t update automatically the zone file unless I reload the ...
0
votes
1answer
77 views

How long it takes to start Bind?

I'm testing DNSSEC and I need to obtain the time in miliseconds it takes to start Bind now that I have signed zones. I don't know if this would be the right way to do it: time svcadm enable ...
3
votes
1answer
2k views

Adding DS record to parent in DNS

I am trying to set up DNSSEC for my domains. Everything seems to work but I get the following error: DNSKEY found at child, but no DS was found at parent. Check for DS records in parent zone ...