3 ms·

I have a DNSSEC signed zone, do I need to do anything? Like generate a new key using this new root key?

kijeda 8y ago
No, this only impacts configuration on the validation side, not signing.
dchest 8y ago
No, because nobody really depends on DNSSEC, so nothing will break: - https://ianix.com/pub/dnssec-outages.html https://ianix.com/pub/dnssec-outages.html - https://twitter.com/tqbf/status/772103926258671618 https://twitter.com/tqbf/status/772103926258671618
- rossy 8y ago
  > because nobody really depends on DNSSEC That's not true. A lot of people use DNSSEC validating public resolvers like 1.1.1.1 and 8.8.8.8, especially on Android devices. I use DNSSEC on my personal domain, and when my zone-resigning cronjob fails, I notice pretty quickly, because the page really does fail to load in my browser.
  - dagenix 8y ago
    Is that a good thing? That sounds like a pretty solid reason not to deploy DNSSEC.
    - tptacek 8y ago
      It's not a good thing. To a first approximation 0% of the mainstream public Internet relies on DNSSEC, so using a DNSSEC-validating resolver will on net get you only new outages; not any additional security, even at the margin. It's a failed protocol that a subset of Linux nerds cheerlead because any classic Internet protocol + "SEC" must be cool, that companies like Cloudflare cheerlead because it's complicated and drives lock-in for them, and that governments cheerlead because it in theory grants control over all web crypto to them.
      - codebje 8y ago
        You can't have DNSSEC outages if no-one is validating DNSSEC. So either there are outages, but a little extra security, or no extra security, but no outages, either.
        tptacek 8y ago
        Sure you can. Virtually no part of the web PKI takes advantage (or ever will take advantage) of DNSSEC. Having DNSSEC enabled on your domain will accomplish nothing for you. But: if you misconfigure DNSSEC, or fail to maintain it, your site will vanish from the Internet for the users that make the mistake of using DNSSEC-validating resolvers. You've gained no security, but you have gained additional outages.
        colde 8y ago
        Of course you gain security, but not in the HTTPS PKI sense. Not that long ago, somebody BGP hijacked Route 53 in order to serve up different IP's for specific domains. Had that domain been using DNSSEC, that attack would have failed for everyone using a validating resolver. That might not be a common attack, but it certainly grants security. This could also help with "rogue" free wifi setups, that try to do something like that as well.
        the_clarence 8y ago
        Were the domains using TLS?
        nybble41 8y ago
        Does it matter? If the attackers can redirect the domain names to their own IP addresses then they can obtain DV certificates for those domains. The security of TLS depends on secure domain name resolution.
        tptacek 8y ago
rrrguy 8y ago
Clients need to update their root keystore, but zones need no change.

No, this only impacts configuration on the validation side, not signing.

No, because nobody really depends on DNSSEC, so nothing will break: - https://ianix.com/pub/dnssec-outages.html https://ianix.com/pub/dnssec-outages.html - https://twitter.com/tqbf/status/772103926258671618 https://twitter.com/tqbf/status/772103926258671618

rossy 8y ago
> because nobody really depends on DNSSEC That's not true. A lot of people use DNSSEC validating public resolvers like 1.1.1.1 and 8.8.8.8, especially on Android devices. I use DNSSEC on my personal domain, and when my zone-resigning cronjob fails, I notice pretty quickly, because the page really does fail to load in my browser.
- dagenix 8y ago
  Is that a good thing? That sounds like a pretty solid reason not to deploy DNSSEC.
  - tptacek 8y ago
    It's not a good thing. To a first approximation 0% of the mainstream public Internet relies on DNSSEC, so using a DNSSEC-validating resolver will on net get you only new outages; not any additional security, even at the margin. It's a failed protocol that a subset of Linux nerds cheerlead because any classic Internet protocol + "SEC" must be cool, that companies like Cloudflare cheerlead because it's complicated and drives lock-in for them, and that governments cheerlead because it in theory grants control over all web crypto to them.
    - codebje 8y ago
      You can't have DNSSEC outages if no-one is validating DNSSEC. So either there are outages, but a little extra security, or no extra security, but no outages, either.
      - tptacek 8y ago
        Sure you can. Virtually no part of the web PKI takes advantage (or ever will take advantage) of DNSSEC. Having DNSSEC enabled on your domain will accomplish nothing for you. But: if you misconfigure DNSSEC, or fail to maintain it, your site will vanish from the Internet for the users that make the mistake of using DNSSEC-validating resolvers. You've gained no security, but you have gained additional outages.
        colde 8y ago
        Of course you gain security, but not in the HTTPS PKI sense. Not that long ago, somebody BGP hijacked Route 53 in order to serve up different IP's for specific domains. Had that domain been using DNSSEC, that attack would have failed for everyone using a validating resolver. That might not be a common attack, but it certainly grants security. This could also help with "rogue" free wifi setups, that try to do something like that as well.
        the_clarence 8y ago
        Were the domains using TLS?
        nybble41 8y ago
        Does it matter? If the attackers can redirect the domain names to their own IP addresses then they can obtain DV certificates for those domains. The security of TLS depends on secure domain name resolution.
        tptacek 8y ago

rrrguy 8y ago

Clients need to update their root keystore, but zones need no change.