Questions tagged [dnssec]

Domain Name System Security Extension is a specification for securing certain kinds of information provided by Domain Name System

Filter by
Sorted by
Tagged with
0
votes
1answer
27 views

DNSSEC I am not able to validate DNSKEY answer

Here is the answer I got for .com.my. DNSKEY: com.my. 3600 IN DNSKEY 257 3 8 BQEAAAABu3FxmZrMlOMXlk2I2LeTsoMre8QaJKw75gSH9G8VCNX6AaVo8hT8qQyfNWDtdM+...
0
votes
0answers
52 views

dnssec-signzone sign a zone use ECDSAP384SHA384 hangs

When I use dnssec-signzone to sign zone file, it's very, very slow.It will take 30mins or more. The ZSK and KSK use Algorithm: 14 (ECDSAP384SHA384) I tried update openssl to 1.1.0 and bind 9.14and 9....
4
votes
1answer
81 views

How to migrate BIND configuration to dnssec-policy from auto-dnssec maintain without disruption?

BIND 9.16 introduced a new dnssec-policy feature as a further more automated DNSSEC key management and signing facility over the long established auto-dnssec maintain functionality. The documentation ...
0
votes
1answer
149 views

What does this bind error mean?

Background I'm trying to setup a recursive DNSSec Server, with the dnssec-lookaside option. Following this guide. Error Message root@dnssec:/home/jose# systemctl status bind9 ● bind9.service - BIND ...
2
votes
1answer
287 views

Is DLV on dnssec deprecated?

I'm trying to set up a recursive DNS that also have its own zone using bind. Now I want to upgrade it to use dnssec but as far as I understood I have to use DLV if I don't own a domain name. ...
0
votes
1answer
98 views

How do I remove a DS record from my parent zone using Amazon Route 53?

My website is currently inaccessible due to the presence of a DS record in the parent zone, when I am using nameservers that don't support DNSSEC. See this question for more context. I am using ...
4
votes
1answer
130 views

What are the downsides of enabling DNSSEC for your website? (Hosted at a shared web host.)

I own a domain name via Google domains and my website is hosted as a shared account with Dream Host. I see that both provide DNSSEC vs old DNS. I was thinking to enable it. But before I do so, I was ...
0
votes
1answer
62 views

BIND and DNSSEC setup debugging

I am trying to get DNSSEC up and running, but I'm having some difficulties getting it working. I am running BIND 9.14.2 (on Windows of all things). BIND is working fine and there's have a number of ...
0
votes
1answer
24 views

How to trust another Nameserver/Zone specificly?

For making sure a resolver is also able to resolve when not connected to the internet (which is usually not the case), I have configured a forward zone: zone "example.com" { type forward; ...
2
votes
1answer
177 views

Why is the DNSSEC Key Tag always 2371?

I was adding DNSSEC to a few of my domains recently, and I noticed that on every single one, the DNSSEC Key Tag was always 2371. What is the point in asking for it if it never changes? (or does it ...
2
votes
3answers
726 views

BIND unable to resolve one domain but works on others

On an SMTP server running bind 9.11 for DNS, DNS resolution is failing for one domain causing an email to that domain to fail. There are no problems resolving other domains. However, it can resolve on ...
1
vote
0answers
393 views

bind9 fails with dnssec-validation on one server but not an identical one on a different network

I'm trying to set up a recursive DNS server on a cloud-based VPS. If I set dnssec-validation no it works fine, but if I set dnssec-validation auto I get status: SERVFAIL from dig. However when I set ...
0
votes
0answers
37 views

Only a single subdomain cannot connect to the server why?

I have a lot of subdomains on azrhymes.com, eg. de.azrhymes.com, es.azrhymes.com, etc. (~20 subdomains) and all of them work (including some very new ones) except ru.azrhymes.com that responds 'we ...
0
votes
1answer
1k views

DNSSEC enable and lookaside

I came across a Bind setup where there is only one DNSSEC value set like this: dnssec-validation yes; and the keys in named.conf.options are declared like this: include "/etc/bind.keys" However, ...
-1
votes
1answer
83 views

How to find documentation about implementing DNSSEC? [closed]

I have a question about the implementation of DNSSEC. I have a DNS Server and I want to implement DNSSEC, but I can't find documentation for this. I have a lot of confusion about this topic since ...
0
votes
2answers
438 views

Why does a dnssec signed zone fail to reload

FreeBSD-12 BIND-9.11 After some effort I have changed the error. Now I see this: 07-Jun-2019 18:01:25.299 zone parschecks/IN/public (unsigned): loaded serial 2019070701 (DNSSEC signed) 07-Jun-2019 ...
3
votes
0answers
72 views

Keeping DNSSEC KSKs offline with BIND9

I am looking to move the private part of the KSK for my domains off my main nameserver. I've tried this with a test domain and get errors like this: dns_dnssec_keylistfromrdataset: error reading /etc/...
1
vote
0answers
168 views

bind-9.11 auto-maintain inline update

We have a stealth master which has several zone secured with DNSSEC. We recently upgraded to 9.11 and enabled auto-maintain and inline-update for DNSSEC. The initial zone resign and load went ...
0
votes
1answer
271 views

DNSSEC Bind-9.11 auto-manage and inline-update

I am trying to understand how Bind manages DNSSEC zone key signatures without external intervention. Specifically what process (named?) detects that a zone signature is about to expire and what are ...
0
votes
1answer
63 views

On FreeBSD what tool is used to dislay the DNSSEC signature expiry date for a zone?

We use FreeBSD-12 and Bind-9.11.6. We have DNSSEC enabled for some of our domains. I wish to verify the signature expiry date for these zones. I cannot seem to locate any information on exactly how ...
1
vote
0answers
279 views

Windows DNS Server with DNSSEC validation break specific domain

I recently enabled DNSSEC validation on our internal DNS Server in our Active Directory environment. Everything was working fine until a couple of days later I noticed that I couldn't reach a certain ...
1
vote
0answers
103 views

DENIC NAST - Generating Compliant DNSSEC Key

I am having a major problem generating a compliant DNSSEC key pair for use with a .de domain name. DENIC have a testbed - Nameserver Predelegation Check Web Interface at https://www.denic.de/en/...
1
vote
1answer
138 views

How To Regenerate and Revoke Lost DNSSEC Keys?

Fedora 27, x64 I need to revoke a DNSSEC key in order to replace it and already know how to generate new keys, etc.; however I had to delete my old keys because they were causing my domains to be ...
-1
votes
1answer
148 views

Authenticating DNS Queries

Is there any way to use a TSIG (or other) key in combination with a DNS query to authenticate into a DNS view for use with recursion? Something like: key trusted-key { algorithm HMAC-SHA256; ...
0
votes
1answer
58 views

Exclude a single record from DNSSEC - is it possible?

In a domain running DNSSEC, is it possible to exclude a single record from DNSSEC? For example, would it be possible to have mail.example.com running DNSSEC, but www.example.com not running DNSSEC? ...
0
votes
3answers
552 views

Secondary Nameserver DNSSEC

I have this hidden master DNS nameserver notifying and updating the two public slave DNS servers: my own VPS running Debian/Bind9 DNS 3rd-party secondary nameserver provider (afraid.org) I finally ...
0
votes
0answers
43 views

adding nsec record for cname flattening

consider this zone: example.org. SOA (...) a.example.org. CNAME b b.example.org. CNAME c c.example.org. A 1.2.3.4 a query for "a.example.org. A" with DNSSEC and CNAME flattening enabled ...
4
votes
2answers
1k views

DNSSEC - How does it protect from an MITM attack?

I have been reading for several hours about DNSSEC and I'm still failing to understand how it protects from MITM attacks. I have also read every question here on serverfault related to DNSSEC. Please ...
0
votes
1answer
106 views

dnsmasq: Block manipulated dns responses pointing at captive portal site

After setting up a raspberry pi based router (behind two other routers) using debian stretch, iptables, dnsmasq and hostapd, I have come to learn a seemingly endless amount of interesting options that ...
0
votes
1answer
509 views

Google DNS SERVFAIL for PTR Lookup, ISP Not Helping

I am in dire need of help! Some of our hosted Exchange users recently are getting NDRs when sending to some domains. I believe error is 554 NO PTR IP FOUND. I swore we had our ISP put in a PTR and ...
2
votes
0answers
1k views

Bind is not resigning DNSSEC zone after zone update and service restart

I'm facing an issue with BIND 9.9.11p1. My configuration is: zone "example1.com" { type master; file "zones/example1.com"; allow-query { any; }; allow-transfer { 1.2.3.4; }; also-notify { ...
0
votes
1answer
397 views

DNSSEC resolution when NS records are not accompanied by A records

Been trying to find the right place to ask this. hopefully this is the place! There are a few subtleties behind DNS and DNSSEC in particular that I am trying to understand. DNSSEC uses a chain of ...
1
vote
2answers
5k views

How to block domains using Bind / Named for local protection?

I am trying to sinkhole/blackhole a list of domains using bind. I think my issue is using "Include" in the WRONG place on the conf. Can someone confirm the blacklist line of code is in the right place?...
0
votes
0answers
375 views

DNSSEC lookups takes incredibly long time (Windows Server)

I would like to ask for help. I have Windows Server 2016 with the DNS server installed. That server is a DC too. The server works like a recursive DNS server for the network and has DNSSEC validation ...
1
vote
2answers
246 views

DNSSEC Zone Signing Key (ZSK)

I've been tasked to look into implementing DNSSEC on our name servers. While the technical side of this (generate keys, sign zones, prepare rollovers) are relatively straightforward, I've run into a ...
0
votes
0answers
83 views

Is it possible to serve a TLSA record from an authoritative server?

RFC 6698 states that a TLSA record should be ignored unless it can be verified with DNSSEC. For clients using a built-in stub resolver, that means checking the AD bit on the response (and trusting ...
0
votes
1answer
790 views

Cannot setup DNSSEC, broken chain of trust

I am trying to set DNSSEC on a domain I own and I ran into an issue. When checking the configuration with the following site, I get an error: http://dnscheck.pingdom.com/troubleshooting.php?domain=...
0
votes
3answers
2k views

Can't access certain subdomain website? DNS NSEC3 issue?

Edited on 2017-10-25. Original question was misleading. We have a website running on the subdomain http://admin.gigantisch.nl/. Ever since the gigantisch.nl domain changed IP addresses, we have been ...
0
votes
1answer
640 views

Bind DNSSEC inline-signing loadkeys fail because zone in multiple views

I'm trying to implement DNSSEC with the bind>=9.9 option inline-sgning. I've previously successfully manually signed the same zone by generating a .signed file with dnssec-signzone. But I don't want ...
0
votes
1answer
489 views

Setup Unbound DNS for both caching/local usage and website ns

I want to use Unbound as caching and as my ns1.domain.com nameserver with DNSSEC. I came across Unbind which looks quite easy to setup and use. unbound-control local_data "mywebsite.com A 11.22.3.44"...
0
votes
2answers
176 views

How to remove a deleted ZSK from BIND?

I set up my (authoritative) BIND nameserver for DNSSEC and installed one ZSK for my currently only zone. In order to test if I can use multiple ZSKs for a single zone, I generated a new key pair and ...
4
votes
1answer
5k views

DNSSEC broken in Windows 2016's DNS server?

I'm currently in the process of migrating a DNS server from Windows 2012 R2 to Windows 2016. However, I have run into an issue with DNSSEC. So far I have just moved one domain, an unused test domain, ...
2
votes
2answers
3k views

Proper way to reload master zone on bind9 doing inline-signing

I have a master BIND9 (v9.10.3) properly serving several signed zones (verified with dnsviz, etc.) I have not been able to find in any documentation a proper way to reload and resign a static zone ...
1
vote
1answer
580 views

Fix broken DNSSEC

I have transferred a .com domain from Namecheap to EuroDNS. Since that day I have the problem that the domain does not resolve from all DNS servers, e.g.: $ host -a flibsy.com 8.8.8.8 Trying "flibsy....
1
vote
1answer
178 views

NSEC3 resource records with RSASHA256 or only NSEC3*?

Is it possible to use NSEC3 resource records with RSASHA256 keys or does NSEC3 require using NSEC3RSASHA1 or NSEC3DSA keys?
8
votes
1answer
4k views

How to remove DNSSEC support from a domain?

A organization has DNSSEC support for their domains. They have a BIND9 as authoritative name server running which also manages the keys. However it was decided to remove DNSSEC. Is it sufficient to ...
1
vote
2answers
269 views

Setting up a BIND server to provide additional records

I've got a nice small VPS from OVH and two domain names (let's call them first.com and second.com). As OVH does not support DNSSEC and CAA records I was informed that I can set up my own DNS server to ...
2
votes
2answers
75 views

What are possible security issues with TLD not being secured with DNSSEC, even if subdomain is?

We are working on a stablished network with a BIND9 server running (as well as many other services). I'm learning and trying to reorganize the old configuration files to comply with the present day (...
0
votes
3answers
376 views

Speed up DNSSEC keygen

I'm rebuilding some DNS boxes and for the life of me I can't remember what I installed that drastically speeds up the dnssec-keygen process. Would anyone know what this might have been or a way I ...
6
votes
3answers
6k views

How to update a zone with auto-dnssec: maintain

I am running an authoritative BIND 9.9.5-9+deb8u8-Debian on Debian Jessie. I have a working zone for robin.info that works properly (various tests report success, such as the one on pingdom.com's DNS ...