i have almost out-of-the-box windows 2003 server which is also domain name server for some users. should i be worried of 5th of may's deployment of dnssec on root name servers ?

i have already run:

dnscmd /Config /EnableEDnsProbes 1

thanks a lot!

ps. my firewalls / network infrastructure do not block udp packets > 512B

my result from ripe test:

Announced buffer size: 1280 bytes

Measured buffer size: 1259 bytes

EDNS enabled: yes

DNSSEC enabled: no

Your resolver does not have DNSSEC enabled.

Note: There will always be a difference between the announced and measured buffer size because of the algorithm used. However this difference should not exceed 300 bytes.

ps #2

this is active directory server so it has dns service which is authoritative dns server for some internal dns zone [not used in public internet]. this server is also used as recursive name server for some internal users.


From what you've said I'm presuming that this is a recursive server, and not an authoritative server.

From the details given, you should have no problems. Your network apparently supports responses > 512 bytes, and your server supports EDNS0.

In any event, you will only ever have problems if your server sends queries to external servers that have the DO bit (DNSSEC OK) set.

Without that flag all responses from the root servers (and any other authoritative servers for that matter) will look exactly the same come May 5th as they did before DNSSEC.

The only other thing you should check is that your network permits outbound DNS queries to work over TCP - so don't ever block outbound tcp/53 on your firewall.

If you need more help, please ask. I'm the author of various ICANN and IETF documents relating to this issue.

  • hi! thanks a lot for your answer. i've included a bit more details in ps#2. there is no problem with outgoing tcp/53 traffic, also larger and fragmented UDP packets on port 53 are forwarded without any problems. should i let this server do recursive work or rather chain it with BIND9 on linux as recursive resolver? thanks again! – pQd Apr 23 '10 at 17:40
  • 1
    Well, if you actually want DNSSEC validation then you'll have a lot more luck with BIND or Unbound than you will with MS DNS. Both also work under Windows - so you don't even have to run Linux if you don't want to. – Alnitak Apr 23 '10 at 18:48
  • ok - i can easily give up requirement for windows to be recursive dns... it can be just authoritative server for AD zone and forward all internal requests to BIND. will that be better? – pQd Apr 23 '10 at 18:50
  • 1
    yup, sounds reasonable. – Alnitak Apr 23 '10 at 20:57

I would think that you would need to worry only if two things apply to your situation:

  1. You use the root hint servers instead of forwarders

  2. Your firewall blocks DNS UDP packets larger than 512 bytes

I know that my firewalls don't support DNS UDP packets larger than 512 bytes so I've switched from using the root hint servers to using Google's public DNS servers for external DNS queries.

  • thanks for the answer. i do use root hint servers but there is no problem with forwarding my traffic [ could you point some reference for that? ]. there is no problem with network infrastructure - it happily forwards udp packets > 512B – pQd Apr 21 '10 at 13:58
  • In W2K3 DNS console bring up the properties of the DNS server, select the forwarders tab, and add the forwarders you want to use. Also, if I'm not mistaken, enabling DNSSEC on your DNS server is only needed if you want your DNS server to implement DNSSEC, which shouldn't be neccessary. – joeqwerty Apr 21 '10 at 14:10
  • thanks. i was probably not precise enough - i know how to enable use of forwarders, my question was - can you provide source that describes possible problems when w2003 starts querying root name servers after 5th of may. thx. – pQd Apr 21 '10 at 14:32

I think best would be you try the tests Ripe explains here, then you may see whether you need to do anything on your server or your firewalls. Everything else would be guess work from my point of view.

If your users are connected by router themselves they should also try the tests, whether the DNS Queries will work. I have a Fritz Router and I needed to apply a workaround as the router only supports up to 512Byte DNS packages.

  • i have included result from ripe test. – pQd Apr 21 '10 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.