Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [dnssec]

Domain Name System Security Extension is a specification for securing certain kinds of information provided by Domain Name System

1
vote
0answers
23 views

Windows DNS Server with DNSSEC validation break specific domain

I recently enabled DNSSEC validation on our internal DNS Server in our Active Directory environment. Everything was working fine until a couple of days later I noticed that I couldn't reach a certain ...
1
vote
0answers
36 views

DENIC NAST - Generating Compliant DNSSEC Key

I am having a major problem generating a compliant DNSSEC key pair for use with a .de domain name. DENIC have a testbed - Nameserver Predelegation Check Web Interface at https://www.denic.de/en/...
1
vote
1answer
52 views

How To Regenerate and Revoke Lost DNSSEC Keys?

Fedora 27, x64 I need to revoke a DNSSEC key in order to replace it and already know how to generate new keys, etc.; however I had to delete my old keys because they were causing my domains to be ...
-1
votes
1answer
42 views

Authenticating DNS Queries

Is there any way to use a TSIG (or other) key in combination with a DNS query to authenticate into a DNS view for use with recursion? Something like: key trusted-key { algorithm HMAC-SHA256; ...
0
votes
1answer
30 views

Exclude a single record from DNSSEC - is it possible?

In a domain running DNSSEC, is it possible to exclude a single record from DNSSEC? For example, would it be possible to have mail.example.com running DNSSEC, but www.example.com not running DNSSEC? ...
0
votes
3answers
126 views

Secondary Nameserver DNSSEC

I have this hidden master DNS nameserver notifying and updating the two public slave DNS servers: my own VPS running Debian/Bind9 DNS 3rd-party secondary nameserver provider (afraid.org) I finally ...
0
votes
0answers
22 views

adding nsec record for cname flattening

consider this zone: example.org. SOA (...) a.example.org. CNAME b b.example.org. CNAME c c.example.org. A 1.2.3.4 a query for "a.example.org. A" with DNSSEC and CNAME flattening enabled ...
3
votes
2answers
469 views

DNSSEC - How does it protect from an MITM attack?

I have been reading for several hours about DNSSEC and I'm still failing to understand how it protects from MITM attacks. I have also read every question here on serverfault related to DNSSEC. Please ...
0
votes
1answer
67 views

dnsmasq: Block manipulated dns responses pointing at captive portal site

After setting up a raspberry pi based router (behind two other routers) using debian stretch, iptables, dnsmasq and hostapd, I have come to learn a seemingly endless amount of interesting options that ...
0
votes
0answers
196 views

Found DS RRset without NS RRset

Searched plenty online and besides one article stating to include NS RRset records, it doesn't list how to perform this. https://www.isc.org/blogs/dnssec-and-lazy-delegation/ I run this command for ...
0
votes
1answer
230 views

Google DNS SERVFAIL for PTR Lookup, ISP Not Helping

I am in dire need of help! Some of our hosted Exchange users recently are getting NDRs when sending to some domains. I believe error is 554 NO PTR IP FOUND. I swore we had our ISP put in a PTR and ...
0
votes
0answers
513 views

Bind is not resigning DNSSEC zone after zone update and service restart

I'm facing an issue with BIND 9.9.11p1. My configuration is: zone "example1.com" { type master; file "zones/example1.com"; allow-query { any; }; allow-transfer { 1.2.3.4; }; also-notify { ...
0
votes
1answer
184 views

DNSSEC resolution when NS records are not accompanied by A records

Been trying to find the right place to ask this. hopefully this is the place! There are a few subtleties behind DNS and DNSSEC in particular that I am trying to understand. DNSSEC uses a chain of ...
1
vote
2answers
2k views

How to block domains using Bind / Named for local protection?

I am trying to sinkhole/blackhole a list of domains using bind. I think my issue is using "Include" in the WRONG place on the conf. Can someone confirm the blacklist line of code is in the right place?...
0
votes
0answers
217 views

DNSSEC lookups takes incredibly long time (Windows Server)

I would like to ask for help. I have Windows Server 2016 with the DNS server installed. That server is a DC too. The server works like a recursive DNS server for the network and has DNSSEC validation ...
1
vote
2answers
135 views

DNSSEC Zone Signing Key (ZSK)

I've been tasked to look into implementing DNSSEC on our name servers. While the technical side of this (generate keys, sign zones, prepare rollovers) are relatively straightforward, I've run into a ...
0
votes
0answers
73 views

Is it possible to serve a TLSA record from an authoritative server?

RFC 6698 states that a TLSA record should be ignored unless it can be verified with DNSSEC. For clients using a built-in stub resolver, that means checking the AD bit on the response (and trusting ...
0
votes
1answer
521 views

Cannot setup DNSSEC, broken chain of trust

I am trying to set DNSSEC on a domain I own and I ran into an issue. When checking the configuration with the following site, I get an error: http://dnscheck.pingdom.com/troubleshooting.php?domain=...
0
votes
3answers
411 views

Can't access certain subdomain website? DNS NSEC3 issue?

Edited on 2017-10-25. Original question was misleading. We have a website running on the subdomain http://admin.gigantisch.nl/. Ever since the gigantisch.nl domain changed IP addresses, we have been ...
0
votes
1answer
287 views

Bind DNSSEC inline-signing loadkeys fail because zone in multiple views

I'm trying to implement DNSSEC with the bind>=9.9 option inline-sgning. I've previously successfully manually signed the same zone by generating a .signed file with dnssec-signzone. But I don't want ...
0
votes
1answer
340 views

Setup Unbound DNS for both caching/local usage and website ns

I want to use Unbound as caching and as my ns1.domain.com nameserver with DNSSEC. I came across Unbind which looks quite easy to setup and use. unbound-control local_data "mywebsite.com A 11.22.3.44"...
0
votes
2answers
64 views

How to remove a deleted ZSK from BIND?

I set up my (authoritative) BIND nameserver for DNSSEC and installed one ZSK for my currently only zone. In order to test if I can use multiple ZSKs for a single zone, I generated a new key pair and ...
2
votes
1answer
2k views

DNSSEC broken in Windows 2016's DNS server?

I'm currently in the process of migrating a DNS server from Windows 2012 R2 to Windows 2016. However, I have run into an issue with DNSSEC. So far I have just moved one domain, an unused test domain, ...
2
votes
2answers
1k views

Proper way to reload master zone on bind9 doing inline-signing

I have a master BIND9 (v9.10.3) properly serving several signed zones (verified with dnsviz, etc.) I have not been able to find in any documentation a proper way to reload and resign a static zone ...
1
vote
1answer
374 views

Fix broken DNSSEC

I have transferred a .com domain from Namecheap to EuroDNS. Since that day I have the problem that the domain does not resolve from all DNS servers, e.g.: $ host -a flibsy.com 8.8.8.8 Trying "flibsy....
1
vote
1answer
125 views

NSEC3 resource records with RSASHA256 or only NSEC3*?

Is it possible to use NSEC3 resource records with RSASHA256 keys or does NSEC3 require using NSEC3RSASHA1 or NSEC3DSA keys?
7
votes
1answer
2k views

How to remove DNSSEC support from a domain?

A organization has DNSSEC support for their domains. They have a BIND9 as authoritative name server running which also manages the keys. However it was decided to remove DNSSEC. Is it sufficient to ...
1
vote
2answers
224 views

Setting up a BIND server to provide additional records

I've got a nice small VPS from OVH and two domain names (let's call them first.com and second.com). As OVH does not support DNSSEC and CAA records I was informed that I can set up my own DNS server to ...
1
vote
2answers
50 views

What are possible security issues with TLD not being secured with DNSSEC, even if subdomain is?

We are working on a stablished network with a BIND9 server running (as well as many other services). I'm learning and trying to reorganize the old configuration files to comply with the present day (...
0
votes
3answers
257 views

Speed up DNSSEC keygen

I'm rebuilding some DNS boxes and for the life of me I can't remember what I installed that drastically speeds up the dnssec-keygen process. Would anyone know what this might have been or a way I ...
4
votes
2answers
3k views

How to update a zone with auto-dnssec: maintain

I am running an authoritative BIND 9.9.5-9+deb8u8-Debian on Debian Jessie. I have a working zone for robin.info that works properly (various tests report success, such as the one on pingdom.com's DNS ...
1
vote
1answer
84 views

How should I request that a TLD implement DNSSEC?

I want to put pressure on the .social TLD so they can implement DNSSec, however the company I purchased the domain name is simply a reseller (NameCheap). I don't think that opening a ticket with ...
1
vote
0answers
143 views

PowerDNS different DNSSEC signatures on slaves

I'm running PowerDNS 4.0.0a2 on Ubuntu 16.04 on a master and four slaves. All machines are using mysql backend on mariadb. All slaves are set up with mysql replication against the master which ...
3
votes
1answer
151 views

DANE Trust Anchor - Self-signed or not

We run a private CA and employ both DNSSEC and DANE. Recently we decided to reissue our CA root and issuer keys as these were generated at 1024 bits when our PKI was set up in 2008. Our original ...
0
votes
1answer
246 views

graceful DNSSEC for private TLD

To use a third party service, I can use their DNS name to resolve their domain names. Unfortunately they use some bad practices like using their own made up TLD, which we'll call tld hereafter. In ...
2
votes
1answer
602 views

DNS “views” and controlling zone transfers with TSIG

Running Bind 9.8.2. I have successfully setup TSIG keys for "views" using a DNS master/server pair. Zone transfers are working as expected between the 2 servers for each view. Before we go live into ...
4
votes
1answer
615 views

Multiple DS records

I was wondering how validating resolvers deal with multiple DS records. Let's say we have a zone with one KSK and one ZSK, but after some key rollover shenanigans there are two DS records in the ...
4
votes
1answer
10k views

bind9 does not resolve dnssec correctly

I have a problem with my dns server setup. My bind server is mainly a cache-server but does also serve some internal domains. It listens only on my private network and serves only requests from there. ...
1
vote
0answers
383 views

dig not giving AD-bit when dnssec is configured

I am working on this Deterlab exercise and I run into some problems when adding DNSSEC to Bind. The server runs BIND 9.7.0-P1. The configurations I have done is the following: Signed zone for google....
2
votes
0answers
398 views

failed loading zone from 'myzone.local.zone': no ttl

I run the following command for dnssec on debian 8. But I get error: # dnssec-signzone -A -3 $(head -c 1000 /dev/random | sha1sum | cut -b 1-16) -N INCREMENT -o myzone.local -t myzone.local.zone ...
3
votes
1answer
742 views

Error using dnssec-signzone in chroot'd bind 9.8 when a zone file includes other files

Using bind 9.8.2 on RHEL 6.5, running chroot'd. I have a zone file that includes other files (it's a zone with a large number of servers in different datacenters, and there's one included file per ...
7
votes
5answers
530 views

No IPv6 & DNSSEC support on cc-TLD? (practical implications)

I'm needing to register some domains that have country code domain extensions, but noticed that those TLDs do not officially support (A) IPv6 or (B) DNSSEC... What limitations or pitfalls should I ...
1
vote
2answers
1k views

Remove DS Records from Parent Zone

We transferred a .se domain to GoDaddy from a small Swedish registrar. It turns out the original domain has DNSSEC setup and the DS records were never removed from the parent zone when it was ...
2
votes
2answers
110 views

Outsourcing Recursive DNS in a Windows Domain Environment

We've been considering utilizing a third-party recursive DNS provider like OpenDNS (or anyone) to provide a layer of antiphishing and DNSSEC validation (without having to implement those features ...
1
vote
1answer
761 views

Using DNSSEC with private TLD

I'm playing with DNSSEC for my domain, my DNS server is dual homed (with suitable limits on what can be queried on the public interface) and covers both my public domain, but also a private top level ...
0
votes
1answer
866 views

Which upstream servers is unbound using? [closed]

In order to have local DNSSEC validation, I set up a Raspberry Pi (having a static IP) with Raspian Jessie and unbound to offer a DNS server to my LAN. After I looked up some tutorials and howtos, I ...
0
votes
1answer
134 views

bind9.10 dnssec inline signing failing

I am pretty sure the ultimate error is this: [\u@r2d2:/home/ex-mailer-domains/domain.com] # dig domain.com +dnssec @8.8.8.8 ; <<>> DiG 9.10.3 <<>> domain.com +dnssec @8.8.8.8 ...
1
vote
1answer
1k views

dnssec remove keys from zone

is there a way to remove all dnssec related stuff from a zone on a running bind server? I configured bind like like here described. If i use rndc signing -clear all domain.tld nothng happens to the ...
2
votes
1answer
959 views

dnssec-keygen key default validation / expiration time

What is the default expire time/period for a key, generated by dnssec-keygen: If i execute: dnssec-keygen -a RSASHA256 -b 2048 -f KSK mydomain.com I get 2 files: (Kmydomain.com.+008+21346.key) ; ...
0
votes
1answer
361 views

Does TSIG and DNSSEC provide encryption of entire DNS packet?

it says TSIG and DNSSEC provide authentication. Does it mean whole DNS traffic would be encrypted so if I do packet capturing I would not be able to parse anything ? Or DNS data is still plain text ...