3 ms·

The latest survey of 250 million zones [1] shows that 10,787,502 zones are DNSSEC signed. And that number continues to increase steadily. [1]: https://stats.dn

The latest survey of 250 million zones [1] shows that 10,787,502 zones are DNSSEC signed. And that number continues to increase steadily. [1]: https://stats.dnssec-tools.org/#summary https://stats.dnssec-tools.org/#summary

vbezhenar 7y ago
What's the deal with DNSSec for ordinary websites? I copied some code from namecheap (my registrar) to Cloudflare (my DNS hoster) and ticked DNSSec box, and it just worked. Literally few minutes. Setting up HTTPS with letsencrypt is thousand times harder and people manage to do that. I guess that webmasters just don't care about DNSSec.
- tptacek 7y ago
  They do not, nor do the security teams of the tech industry or the financial industry (the second-best security staffed industry vertical) or really any other industry, because DNSSEC is silly and doesn't do anything important. I will concede that if you centralize all your stuff on Cloudflare, it's very easy to set up. That's why Cloudflare makes it so easy to set up. Cloudflare is one of a single-digit small number of exceptions to the rule that big tech companies don't use DNSSEC; they do, of course, because it's part of the product they sell.
- deleted 7y ago
  [deleted]
- alwillis 7y ago
  It’s more likely they are confused because of all of the conflicting opinions on the web. You’ll see people on HN who seem to have a personal vendetta against DNSSEC for reasons that only make sense to them. For example, a common argument is that DNSSEC is controlled by world governments, as if certificate authorities and domain registries are free-standing entities separate from the countries they’re based in. Many of these folks are actually misinformed, but there are quite a few who are clearly disingenuous about how DNSSEC works. Let's clear this up: DNSSEC creates a chain of trust, from the root zone (the “.” at the top of the domain hierarchy) to your zone, such as example.com. The chain is . --> com --> example.com Browsers trust hundreds of root and intermediate certificate authorities that can issue a certificate for any domain. This has happened more than a few times. The DNSSEC trust chain is far more constrained and you get to create the KSK and zone signing keys (ZSK) for your zone. Root Key Signing Key (KSK) is the public key of the key pair that’s for the root zone. The private key of this key pair is used to sign the top-level domains such as .com, .net, .org, etc. The root KSK ships with all of the DNSSEC-supporting DNS resolvers and enables them to verify the authenticity of the trust chain. It’s not clear what the paranoia is about; the public KSK is public; it’s referenced on thousands of websites and everyone involved with running the global internet knows about it. [1] If something malicious or nefarious were to happen, all registries, regional internet operators, ISPs, etc. would immediately know about it. All of the DNS resolvers that support DNSSEC have a built-in way to automatically upgrade to a new KSK when it’s released [2]. Even if you imagine the world’s governments colluding to change the key for whatever nefarious reason, DNS resolvers know not to trust any new key unless it’s been available for 30 days. (The new key would need to be signed by the old key anyway, but for the sake of arguement, lets pretend that’s not neccessary.) What those people neglect to mention is you’re not required to trust the root KSK. You can decide where your chain of trust starts if you wish, including only trusting your own zone. You can also create islands of trust, zones or domains you feel comfortable with. Anyway, you can read rational, fact-based responses to these and other DNSSEC falsehoods. [3] [1]: https://www.iana.org/domains/root https://www.iana.org/domains/root [2]: https://tools.ietf.org/html/rfc5011 https://tools.ietf.org/html/rfc5011 [3]: https://easydns.com/blog/2015/08/06/for-dnssec/ https://easydns.com/blog/2015/08/06/for-dnssec/
  - tptacek 7y ago
    You just wrote 500 words that firmly establish that DNSSEC is controlled by world governments, and concluded as if you'd said something else. Wild.
- alwillis 7y ago
  What's the deal with DNSSec for ordinary websites? Even if don't use Cloudflare (or Google Cloud, which also supports DNSSEC), signing your zone has gotten pretty easy. All of the major authoritative DNS servers support automatic DNSSEC signing and automatic key rollover of the Key Signing Key (KSK) and Zone Signing Key (ZSK). For example, here's the configuration for automatic DNSSEC signing for Knot DNS [1]: zone: - domain: myzone.test dnssec-signing: on That’s all that’s required to DNSSEC sign a zone using Knot’s default settings. But if you want all of the bells and whistles, you can have that too. Let me say just having SSHFP support thanks to DNSSEC turns using SSH from annoying to "it just works" [2] if you admin a server. Setting up DNSSEC was difficult back in the day, but it’s pretty easy now. [1]: https://www.knot-dns.cz/docs/2.9/html/configuration.html#automatic-dnssec-signing https://www.knot-dns.cz/docs/2.9/html/configuration.html#aut... [2]: https://weberblog.net/sshfp-authenticate-ssh-fingerprints-via-dnssec/ https://weberblog.net/sshfp-authenticate-ssh-fingerprints-vi...
tptacek 7y ago
These stats are damning for at least three reasons: * You bring them up regularly without acknowledging that they're due in large part to European registrars that automatically sign new domains for their customers and hold the keys, which is security theater. * The stats themselves are ludicrously misleading; for instance, they claim that 97% of .COM domains are signed despite listing only 1.5MM signed .COM domains, which is a tiny fraction of all of .COM (they are in reality listing the percentage of domains that have DNSSEC and properly validating signatures, and while it's amusing that something like 4% of DNSSEC domains don't even verifying, it's not evidence of adoption). * The overwhelming majority of these domains don't matter at all, and a quick check of the lists of popular domains, from Alexa or the Moz 500, shows that virtually none of the popular domains outside the USG (where DNSSEC was formerly but is no longer required) are signed. You can keep bringing this up, but all you're doing is giving me opportunities to put more facts about the failure of DNSSEC on the table, which is something I'm not actually all that committed to doing.
- tptacek 7y ago
  Added fun fact: if you click the chart link for .COM, DNSSEC adoption appears to have gone down.

vbezhenar 7y ago

What's the deal with DNSSec for ordinary websites? I copied some code from namecheap (my registrar) to Cloudflare (my DNS hoster) and ticked DNSSec box, and it just worked. Literally few minutes. Setting up HTTPS with letsencrypt is thousand times harder and people manage to do that. I guess that webmasters just don't care about DNSSec.

tptacek 7y ago
They do not, nor do the security teams of the tech industry or the financial industry (the second-best security staffed industry vertical) or really any other industry, because DNSSEC is silly and doesn't do anything important. I will concede that if you centralize all your stuff on Cloudflare, it's very easy to set up. That's why Cloudflare makes it so easy to set up. Cloudflare is one of a single-digit small number of exceptions to the rule that big tech companies don't use DNSSEC; they do, of course, because it's part of the product they sell.
deleted 7y ago
[deleted]
alwillis 7y ago
It’s more likely they are confused because of all of the conflicting opinions on the web. You’ll see people on HN who seem to have a personal vendetta against DNSSEC for reasons that only make sense to them. For example, a common argument is that DNSSEC is controlled by world governments, as if certificate authorities and domain registries are free-standing entities separate from the countries they’re based in. Many of these folks are actually misinformed, but there are quite a few who are clearly disingenuous about how DNSSEC works. Let's clear this up: DNSSEC creates a chain of trust, from the root zone (the “.” at the top of the domain hierarchy) to your zone, such as example.com. The chain is . --> com --> example.com Browsers trust hundreds of root and intermediate certificate authorities that can issue a certificate for any domain. This has happened more than a few times. The DNSSEC trust chain is far more constrained and you get to create the KSK and zone signing keys (ZSK) for your zone. Root Key Signing Key (KSK) is the public key of the key pair that’s for the root zone. The private key of this key pair is used to sign the top-level domains such as .com, .net, .org, etc. The root KSK ships with all of the DNSSEC-supporting DNS resolvers and enables them to verify the authenticity of the trust chain. It’s not clear what the paranoia is about; the public KSK is public; it’s referenced on thousands of websites and everyone involved with running the global internet knows about it. [1] If something malicious or nefarious were to happen, all registries, regional internet operators, ISPs, etc. would immediately know about it. All of the DNS resolvers that support DNSSEC have a built-in way to automatically upgrade to a new KSK when it’s released [2]. Even if you imagine the world’s governments colluding to change the key for whatever nefarious reason, DNS resolvers know not to trust any new key unless it’s been available for 30 days. (The new key would need to be signed by the old key anyway, but for the sake of arguement, lets pretend that’s not neccessary.) What those people neglect to mention is you’re not required to trust the root KSK. You can decide where your chain of trust starts if you wish, including only trusting your own zone. You can also create islands of trust, zones or domains you feel comfortable with. Anyway, you can read rational, fact-based responses to these and other DNSSEC falsehoods. [3] [1]: https://www.iana.org/domains/root https://www.iana.org/domains/root [2]: https://tools.ietf.org/html/rfc5011 https://tools.ietf.org/html/rfc5011 [3]: https://easydns.com/blog/2015/08/06/for-dnssec/ https://easydns.com/blog/2015/08/06/for-dnssec/
- tptacek 7y ago
  You just wrote 500 words that firmly establish that DNSSEC is controlled by world governments, and concluded as if you'd said something else. Wild.
alwillis 7y ago
What's the deal with DNSSec for ordinary websites? Even if don't use Cloudflare (or Google Cloud, which also supports DNSSEC), signing your zone has gotten pretty easy. All of the major authoritative DNS servers support automatic DNSSEC signing and automatic key rollover of the Key Signing Key (KSK) and Zone Signing Key (ZSK). For example, here's the configuration for automatic DNSSEC signing for Knot DNS [1]: zone: - domain: myzone.test dnssec-signing: on That’s all that’s required to DNSSEC sign a zone using Knot’s default settings. But if you want all of the bells and whistles, you can have that too. Let me say just having SSHFP support thanks to DNSSEC turns using SSH from annoying to "it just works" [2] if you admin a server. Setting up DNSSEC was difficult back in the day, but it’s pretty easy now. [1]: https://www.knot-dns.cz/docs/2.9/html/configuration.html#automatic-dnssec-signing https://www.knot-dns.cz/docs/2.9/html/configuration.html#aut... [2]: https://weberblog.net/sshfp-authenticate-ssh-fingerprints-via-dnssec/ https://weberblog.net/sshfp-authenticate-ssh-fingerprints-vi...

tptacek 7y ago

These stats are damning for at least three reasons: * You bring them up regularly without acknowledging that they're due in large part to European registrars that automatically sign new domains for their customers and hold the keys, which is security theater. * The stats themselves are ludicrously misleading; for instance, they claim that 97% of .COM domains are signed despite listing only 1.5MM signed .COM domains, which is a tiny fraction of all of .COM (they are in reality listing the percentage of domains that have DNSSEC and properly validating signatures, and while it's amusing that something like 4% of DNSSEC domains don't even verifying, it's not evidence of adoption). * The overwhelming majority of these domains don't matter at all, and a quick check of the lists of popular domains, from Alexa or the Moz 500, shows that virtually none of the popular domains outside the USG (where DNSSEC was formerly but is no longer required) are signed. You can keep bringing this up, but all you're doing is giving me opportunities to put more facts about the failure of DNSSEC on the table, which is something I'm not actually all that committed to doing.

tptacek 7y ago
Added fun fact: if you click the chart link for .COM, DNSSEC adoption appears to have gone down.