5 ms·

How much difficulty is added by DNSSEC?

by remram 5y ago

petee 5y ago
Not much but you should have a good grasp first, and the implications (easy to add, tougher to remove) There are tools to automate resigning, but personally I just do it manually once a year for fun.
rhizome 5y ago
Less than the amount of difficulty added to driving a car that can only be adjusted by poking at a TV mounted some place where you aren't looking at the road. Sure, fixing that squeaky door is "easy," but have you ever heard the adage that every home project involves three trips to the hardware store? There may be technical aspects that few of us can implement from scratch and on the first try, but at the same time I also don't know how to build a good broom. These concerns are not insurmountable, especially with the network effects of people being in the same boat. How easy is it to find a good handyman without asking anybody? You don't have to.
- remram 5y ago
  The question was about DNSSEC.
brian_cunnie 5y ago
I don't know how difficult it is to set up DNSSEC, but I do know I had to disable it on my internal BIND DNS server because it wasn't resolving google.com ("query failed (broken trust chain) for www.google.com/IN/A at query.c"): I had to modify my default BIND options to disable DNSSEC: options { dnssec-enable no; dnssec-validation no;
- m3047 5y ago
  If you want DNSSEC to work, be sure you set up NTP and that it's working properly.
  - tadfisher 5y ago
    Also, NAT64 breaks DNSSEC (by design), so some exclusion rules are needed.
hsbauauvhabzb 5y ago
In late 2019 I scanned Fortune 500 for DNSSEC on their top domain, exactly one entity was using it. At the time azures stance on dnssec support was that https certs should suffice. I think it’s a dead tech.
- b112 5y ago
  You haven't lived, until you cannot update the time via ntp, because no dns, because dnssec records aren't valid, because the time is wrong.... This dnssec/ntp dependency loop is absurd, and it is incomprehensible that ntp/dns can break this way.
  - ianai 5y ago
    Could you fix that? I've had mixed results trying to resolve such NTP related issues.
    - b112 5y ago
      I think using IPs for NTP servers, or disabling dnssec are your only options. Both show how silly it all is, IMO.
- tptacek 5y ago
  Quick, easy project! I did it just now (finding a list of F500 domains was the hardest part), and 9% of the Fortune 500 is signed.
egberts1 5y ago
Not at all … nowadays. In fact, I run my own private Internet complete with DNSSEC for my white lab. I used Bind v9.16+ and wrote some bash tools to generate in a flexible manner the named configuration files. Can generate private root servers, private TLD, split-horizon, bastion, and hidden-master.
- egberts1 5y ago
  link to generate named configuration files. https://github.com/egberts/easy-admin/tree/main/500-dns https://github.com/egberts/easy-admin/tree/main/500-dns
belorn 5y ago
adding DNSSEC validation isn't hard (a few options), but as others has commented one have to be a bit aware that dnssec validation might then fail from time to time. Validating other peoples security setup mean occasionally that people mess up and validation fails. I have been running with validation on 10-20 years, and maybe once a year I notice a service that is down because failing validation. It is a bit like expired certificates on https back in the days before most sites started to use automation for renewing. Adding DNSSEC to a domain name is more work. You need a registrar that support it, and then depending on what DNS server program you are running you might need to install a signer, a key storage, monitoring and scripts that talks between the different parts of the chain. I have heard that the latest version of bind might now ship with all the required parts built in, but I have yet to test it. It a bit far yet from simply uncommenting an option, and the protocols for talking with registrars is being actively discussed and worked on during technical conferences.
southerntofu 5y ago
It's work, but it's not difficult. Documentation is good and some daemons like BIND take care of key rollovers automatically.

How much difficulty is added by DNSSEC?

by remram 5y ago

How much difficulty is added by DNSSEC?

Not much but you should have a good grasp first, and the implications (easy to add, tougher to remove) There are tools to automate resigning, but personally I just do it manually once a year for fun.

rhizome 5y ago

Less than the amount of difficulty added to driving a car that can only be adjusted by poking at a TV mounted some place where you aren't looking at the road. Sure, fixing that squeaky door is "easy," but have you ever heard the adage that every home project involves three trips to the hardware store? There may be technical aspects that few of us can implement from scratch and on the first try, but at the same time I also don't know how to build a good broom. These concerns are not insurmountable, especially with the network effects of people being in the same boat. How easy is it to find a good handyman without asking anybody? You don't have to.

remram 5y ago
The question was about DNSSEC.

brian_cunnie 5y ago

I don't know how difficult it is to set up DNSSEC, but I do know I had to disable it on my internal BIND DNS server because it wasn't resolving google.com ("query failed (broken trust chain) for www.google.com/IN/A at query.c"): I had to modify my default BIND options to disable DNSSEC: options { dnssec-enable no; dnssec-validation no;

m3047 5y ago
If you want DNSSEC to work, be sure you set up NTP and that it's working properly.
- tadfisher 5y ago
  Also, NAT64 breaks DNSSEC (by design), so some exclusion rules are needed.

hsbauauvhabzb 5y ago

In late 2019 I scanned Fortune 500 for DNSSEC on their top domain, exactly one entity was using it. At the time azures stance on dnssec support was that https certs should suffice. I think it’s a dead tech.

b112 5y ago
You haven't lived, until you cannot update the time via ntp, because no dns, because dnssec records aren't valid, because the time is wrong.... This dnssec/ntp dependency loop is absurd, and it is incomprehensible that ntp/dns can break this way.
- ianai 5y ago
  Could you fix that? I've had mixed results trying to resolve such NTP related issues.
  - b112 5y ago
    I think using IPs for NTP servers, or disabling dnssec are your only options. Both show how silly it all is, IMO.
tptacek 5y ago
Quick, easy project! I did it just now (finding a list of F500 domains was the hardest part), and 9% of the Fortune 500 is signed.

egberts1 5y ago

Not at all … nowadays. In fact, I run my own private Internet complete with DNSSEC for my white lab. I used Bind v9.16+ and wrote some bash tools to generate in a flexible manner the named configuration files. Can generate private root servers, private TLD, split-horizon, bastion, and hidden-master.

egberts1 5y ago
link to generate named configuration files. https://github.com/egberts/easy-admin/tree/main/500-dns https://github.com/egberts/easy-admin/tree/main/500-dns

belorn 5y ago

adding DNSSEC validation isn't hard (a few options), but as others has commented one have to be a bit aware that dnssec validation might then fail from time to time. Validating other peoples security setup mean occasionally that people mess up and validation fails. I have been running with validation on 10-20 years, and maybe once a year I notice a service that is down because failing validation. It is a bit like expired certificates on https back in the days before most sites started to use automation for renewing. Adding DNSSEC to a domain name is more work. You need a registrar that support it, and then depending on what DNS server program you are running you might need to install a signer, a key storage, monitoring and scripts that talks between the different parts of the chain. I have heard that the latest version of bind might now ship with all the required parts built in, but I have yet to test it. It a bit far yet from simply uncommenting an option, and the protocols for talking with registrars is being actively discussed and worked on during technical conferences.

southerntofu 5y ago

It's work, but it's not difficult. Documentation is good and some daemons like BIND take care of key rollovers automatically.