DNSSEC - ArchWiki

Jump to content

# DNSSEC

From ArchWiki

This article or section needs expansion.

Reason: Explain DNSSEC signing. (Discuss in Talk:DNSSEC)

Related articles

- DANE
- Unbound#DNSSEC validation

From the DNSSEC Wikipedia article:

  The Domain Name System Security Extensions (DNSSEC) is a suite of Internet Engineering Task Force (IETF) specifications for securing certain kinds of information provided by the Domain Name System (DNS) as used on Internet Protocol (IP) networks. It is a set of extensions to DNS which provide to DNS clients (resolvers) origin authentication of DNS data, authenticated denial of existence, and data integrity, but not availability or confidentiality.

## Install a DNSSEC-validating resolver

To ensure DNSSEC is validated system-wide, setup a local DNS server that validates DNSSEC records and configure resolv.conf(5) to use it so that all DNS lookups go through it. See Domain name resolution#DNS servers for available validating resolvers. Note that some DNS servers require specific options to enable DNSSEC validation.

If you attempt to visit a site with a bogus (spoofed) IP address, the validating resolver will prevent you from receiving the invalid DNS data and your browser (or other application) will be told there is no such host. Since all DNS lookups go through the validating resolver, you do not need software that has DNSSEC support built-in when using this option.

Note DNSSEC validation only protects against spoofed records for signed zones (domains). It does not protect unsigned domains such as archlinux.org.

### Test the local validating resolver

#### From a terminal

To test if your local resolver properly validates DNSSEC, use a DNS lookup utility that supports setting the `DO` ("DNSSEC OK") bit, such as drill(1).

Test if the resolver does not return an answer for a domain with an invalid signature such as badsig.test.dnscheck.tools, rhybar.cz or dnssec-failed.org:

    $ drill -D badsig.test.dnscheck.tools

    ;; ->>HEADER<<- opcode: QUERY, rcode: SERVFAIL, id: 5610
    ;; flags: qr rd ra ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;; badsig.test.dnscheck.tools.    IN      A

    ;; ANSWER SECTION:

    ;; AUTHORITY SECTION:

    ;; ADDITIONAL SECTION:

    ;; Query time: 44 msec
    ;; EDNS: version 0; flags: do ; udp: 1232
    ; EDE: 6 (DNSSEC Bogus): 49 37 34 56 (I74V)
    ;; SERVER: 127.0.0.1
    ...

The return code should be `SERVFAIL` (server failure), the answer section should be empty and flags should not contain `ad` (authenticated data).

Next, test a domain with a valid signature:

    $ drill -D test.dnscheck.tools

    ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 20952
    ;; flags: qr rd ra ad ; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0
    ;; QUESTION SECTION:
    ;; test.dnscheck.tools.   IN      A

    ;; ANSWER SECTION:
    test.dnscheck.tools.      5       IN      A       116.203.95.251
    ...

    ;; AUTHORITY SECTION:

    ;; ADDITIONAL SECTION:

    ;; Query time: 45 msec
    ;; EDNS: version 0; flags: do ; udp: 1232
    ;; SERVER: 127.0.0.1
    ...

The query should return successfully and contain the `ad` (authenticated data) flag.

#### From a web browser

Note To ensure you are testing the local resolver, make sure application-level DNS is not enabled in your web browser.

Multiple websites provide tests that check if your DNS resolver validates DNSSEC:

- http://www.dnssec-or-not.com/
- https://dnscheck.tools/
- https://wander.science/projects/dns/dnssec-resolver-test/
- https://internet.nl/connection/

## Recursive query with DNSSEC validation

Note To enable DNSSEC validation system-wide, set up a DNSSEC-validating resolver. See #Install a DNSSEC-validating resolver.

To validate DNSSEC for a domain without involving a recursive resolver, use a DNS lookup utility that can trace a domain starting from a the DNS root. E.g. drill(1) (from ldns) or dig(1) (from bind).

With drill, use the `-D` option to set the `DO` (DNSSEC OK) bit and the `-T` option to trace from the root name servers down to the domain being resolved:

    $ drill -DT example.com

Replace `example.com` with a domain name for which you want to preform DNSSEC validation.

For a domain with an invalid DNSSEC signature, the result should end with the following lines:

    $ drill -DT badsig.test.dnscheck.tools

    [B] badsig.test.dnscheck.tools.   1       IN      A       116.203.95.251
    ;; Error: Bogus DNSSEC signature
    ;;[S] self sig OK; [B] bogus; [T] trusted; [U] unsigned

For a domain with a trusted signature, the result should end with the following lines:

    $ drill -DT test.dnscheck.tools

    [T] test.dnscheck.tools.  1       IN      A       116.203.95.251
    ;;[S] self sig OK; [B] bogus; [T] trusted; [U] unsigned

## Enable DNSSEC in specific software

This article or section is being considered for removal.

Reason: None of the links list any applications that validate DNSSEC themselves and all the browser extensions are long dead. (Discuss in Talk:DNSSEC)

If you choose not to #Install a DNSSEC-validating resolver, you need to use software that has DNSSEC support builtin. Often this means you must patch the software yourself. Hopefully, a full list of several patched applications will eventually (Dec 2020) be found at [1]. Additionally, some web browsers, some of them mentioned at [2], have extensions or add-ons that can be installed to implement DNSSEC without patching the program.

## See also

- DNSSEC-Tools
- DNSSEC Visualizer - a tool for visualizing the status of a DNS zone.
- Red Hat: Securing DNS Traffic with DNSSEC - thorough article on implementing DNSSEC with unbound. Note that some tools are Red Hat specific and not found in Arch Linux.
- Wikipedia:Domain Name System Security Extensions
- dns_tools — Tool to simplify managing DNSSEC zones.

  https://github.com/gene-git/dns_tools || dns_toolsAUR

Categories:

- Encryption
- Domain Name System

Hidden categories:

- Pages or sections flagged with Template:Expansion
- Sections flagged with Template:Remove

DNSSEC
Add topic