I hear http://www.isoc.org/ has Domain Name System Security Extensions on its DNS records.

How do I see and verify the DNS using the tool dig?

  • 1
    Your question includes an URL when it should be a domain name. An URL is not "signed"... – bortzmeyer Jun 25 '10 at 7:00

The dig command is simple:

% dig +dnssec www.isoc.org.

; <<>> DiG 9.6.0-APPLE-P2 <<>> +dnssec www.isoc.org.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49304
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 7, ADDITIONAL: 1

; EDNS: version: 0, flags: do; udp: 4096
;www.isoc.org.          IN  A

www.isoc.org.       86382   IN  A
www.isoc.org.       86382   IN  RRSIG   A 7 3 86400 20100706205007 20100622205007 56495 isoc.org. ETERh/blyD1LvW+hCeET9Zy/XTdTewilU8nhA5HCGtNoccdjPN/4pBg6 Vv2S/nJTZfQu7S1KwFJpijSg0n81A8Fpr1rjlS4AfKZgiSA6ureGDOzZ J4MImGFb9h1lG7qBrJ3Psmzs292obZfA98oJstsTzd4tNwFQf5bp5pDJ KoU=

Note two things:

  1. The +dnssec flag - this asks your DNS server to validate the zone data.
  2. The ad entry in the flags line of the response. This confirms that the zone data is correct.

[if the zone data was incorrect the server would have returned a SERVFAIL error instead]

However, your DNS server won't actually return that ad flag unless it has been configured to perform DNSSEC validation itself. Mine has, of course.

You can enable DNSSEC in your recursive BIND server by adding the following lines to your named.conf file:

    dnssec-enable yes;
    dnssec-validation yes;

and a copy of the root zone's public key. Other domain names can then be validated by following the chain of signatures through the DNS hierarchy.

You'll also need a fairly recent version of your DNS software - only the newer versions support the RSA/SHA-256 encryption algorithm that'll be used to sign the root. That means BIND 9.6.2+, or Unbound 1.4.0+

  • 1
    yes I don't see that "ad" flag. Is there a DNS server I can publicly query? I see Google's does not support DNSsec either. dig +dnssec www.isoc.org @ – hendry Jun 24 '10 at 13:44
  • 3
    DNS OARC has some: dns-oarc.net/oarc/services/odvr – Alnitak Jun 24 '10 at 14:01
  • 3
    @hendry: Google's does dnssec validation now, via – nealmcb May 25 '15 at 4:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.