5 ms·

I work in a field where we deploy software as a service for customers in various regulated fields, and DNSSEC is something that auditors look for as a checkbox

I work in a field where we deploy software as a service for customers in various regulated fields, and DNSSEC is something that auditors look for as a checkbox to check that DNS is secured. So far we've let AWS Route53 deal with the whole DNSSEC thing, but it has made moving hosted zones from one AWS account to another more difficult and more troublesome than it should have been, and making sure that DNSSEC is setup on all of them is frustrating and annoying. Thankfully we haven't encountered any issues with DNSSEC signing causing downtime, but I expect it will happen when someone misconfigures a DNSSEC record somewhere and now we gotta wait for the caches to empty/clear.

tptacek 3y ago
Which audit requires DNSSEC? SOC2 certainly doesn't. ISO doesn't. HITRUST doesn't. PCI doesn't. FedRAMP might (we'll see how much longer that remains the case). Most firms aren't DNSSEC-signed, most especially those with well-resourced security teams, the kind that collect all the available audit certifications because they have teams dedicated to doing that.
- 616c 3y ago
  Why might re FedRAMP?
  - tptacek 3y ago
    There's a historic DNSSEC requirement from the USG, which is actually a big chunk of the reason anyone invested in DNSSEC in the early 201x's. But then it got rescinded, but then it stuck in some of the OMB documents, and it's become a weird political football (in the fleeting moments anybody thinks about it) so we're in a weird limbo where every once in awhile teams like Slack turn it on to close some FedGov business and fall off the entire Internet for a half day when DNSSEC eats them.
    - skissane 3y ago
      The Australian government’s offical cybersecurity guidelines recommend - but do not require - Australian government agencies to implement DNSSEC, “where possible” and especially on their “principal domains”. In a competitive procurement, if another vendor says “you want DNSSEC? No problem!”, while you are saying “we don’t support that” or trying to argue against the recommendation - that is unlikely to help in winning the deal. If your product is miles ahead of the competition, it might not matter; if it is close, this might be the thing that loses it. https://www.cyber.gov.au/sites/default/files/2023-03/5.%20Gateway%20Security%20Guidance%20package%20-%20Gateway%20Technology%20Guides.pdf https://www.cyber.gov.au/sites/default/files/2023-03/5.%20Ga... page 18 I imagine many other (wealthy country) governments worldwide would have similar internal guidance.
    - anonymousiam 3y ago
      It's funny how the USG might be conflicted with both an interest in DNSSEC adoption, and an interest in preventing its adoption. Less than a year ago I was having DNS problems reaching a subnet in the spaceforce.mil domain (via AFRC Desktop Anywhere). After some troubleshooting, I determined that the DNS server for their subnet was not configured for DNSSEC and my client was configured to refuse unauthenticated resolvers. Everything worked fine once I turned off DNSSEC locally. DNSSEC can prevent spoofing via MITM, which is something that lots of governments do, so I can see why they might not want everyone to adopt it. On the other hand, DNSSEC can help to secure network communication, so I can see why they might want to adopt it.
      - nightpool 3y ago
        > DNSSEC can prevent spoofing via MITM, which is something that lots of governments do, so I can see why they might not want everyone to adopt it. Only if you're NOT using HTTPS, right? In which case your traffic is already trivially spoofable, so you're not really gaining anything else by using DNSSEC there.
      - tptacek 3y ago
        DNSSEC is literally a key escrow system for the North American TLDs. There's no conflict: the USG people who know what DNSSEC is want it bad.
- X-Istence 3y ago
  It's a requirement from some of our customers in the financial industry, as well as gov't. It's something various security firms have asked for, and it's a checkbox we will continue to just check. No matter how useless I think it is.
  - tptacek 3y ago
    That's fine, I understand. I'm not telling you how to live your life. All I'll say is: there are SOC2 firms that will also tell you to turn DNSSEC on. You can tell them to go fuck themselves, and you'll be just fine. I don't know if that's the case with your NY-FI customers (none of the major investment banks are signed, nor are any of the exchanges, nor are the largest hedge funds and prop traders, but that's neither here nor there); only you know how to handle them. I'm just here to establish that the mainstream security audits definitely don't require DNSSEC. :)
    - amluto 3y ago
      The finance systems I’m familiar with generally don’t rely on DNS for security and, more commonly, don’t rely on it at all. For systems operating over the open Internet, the most common security mechanisms involve pre-shared key pairs. For systems not on Internet, IP (v4) addresses are generally used directly. I’m actually generally disappointed that TLS in the context of web browsers essentially only uses the CA system for identification and security. It’s wrong at both ends of the spectrum. There are systems where manual key distribution would be fine, and avoiding the CAs as a weak point would be beneficial. And there are systems where the CA system flat out does not work (e.g. anything where the servers are not connected to the Internet and do not even have every-few-days Internet access). Neither of these use cases are handled well by web browsers. (DNSSEC doesn’t help either, of course.)
      - bruce511 3y ago
        >> (e.g. anything where the servers are not connected to the Internet and do not even have every-few-days Internet access Actually it's possible to use the CA system on a closed LAN. A) register a domain. For example company-lan.com. B) assign each server on your Lan with a name and (local) address. Eg, daisy.company-lan.com, resolving to say 192.168.1.1 Clearly this address is only useful when used inside your lan. C) provision certificates for this address using the DNS-Challenge approach rather than the HTTP-challenge approach. (Bonus tip; using a DNS provider with a good API makes the process automateable).
donttellmypeers 3y ago
Does Route53 let you manage the DNSKEY RRset (so you can add a DNSKEY to the set yourself) or do they have some sort of facade you have to interact with instead?
- X-Istence 3y ago
  Route53 signs the zone itself, and the key is managed using AWS KMS.
  - donttellmypeers 3y ago
    That's an answer to a different question. I asked if they let you put a DNSKEY RR in the RRset they serve. (To be clear: I'm not asking if they will import private keys and sign with them or anything like that, just if they'll let you place an additional DNSKEY in the RRset they serve.)
    - wlonkly 3y ago
      I had to add a DS record to a Route53 zone just the other day, and when I did, I didn't see a DNSKEY option in the list of records. Don't count on that 100% because I wasn't looking for it, but I definitely don't recall seeing it.
- deleted 3y ago
  [deleted]
adrr 3y ago
Route53 doesn't even let you add your key without making multiple entries and splitting the key.
- X-Istence 3y ago
  You still have the add the DS records for the hosted zones to the parent hosted zone... The key for a hosted zone is managed using AWS KMS.
hannob 3y ago
This is an argument against checkbox "audits", not an argument for DNSSEC.
jedisct1 3y ago
Even Google doesn't enable DNSSEC. In the future, ECH may become a justification for enabling it, though.

tptacek 3y ago

Which audit requires DNSSEC? SOC2 certainly doesn't. ISO doesn't. HITRUST doesn't. PCI doesn't. FedRAMP might (we'll see how much longer that remains the case). Most firms aren't DNSSEC-signed, most especially those with well-resourced security teams, the kind that collect all the available audit certifications because they have teams dedicated to doing that.

616c 3y ago
Why might re FedRAMP?
- tptacek 3y ago
  There's a historic DNSSEC requirement from the USG, which is actually a big chunk of the reason anyone invested in DNSSEC in the early 201x's. But then it got rescinded, but then it stuck in some of the OMB documents, and it's become a weird political football (in the fleeting moments anybody thinks about it) so we're in a weird limbo where every once in awhile teams like Slack turn it on to close some FedGov business and fall off the entire Internet for a half day when DNSSEC eats them.
  - skissane 3y ago
    The Australian government’s offical cybersecurity guidelines recommend - but do not require - Australian government agencies to implement DNSSEC, “where possible” and especially on their “principal domains”. In a competitive procurement, if another vendor says “you want DNSSEC? No problem!”, while you are saying “we don’t support that” or trying to argue against the recommendation - that is unlikely to help in winning the deal. If your product is miles ahead of the competition, it might not matter; if it is close, this might be the thing that loses it. https://www.cyber.gov.au/sites/default/files/2023-03/5.%20Gateway%20Security%20Guidance%20package%20-%20Gateway%20Technology%20Guides.pdf https://www.cyber.gov.au/sites/default/files/2023-03/5.%20Ga... page 18 I imagine many other (wealthy country) governments worldwide would have similar internal guidance.
  - anonymousiam 3y ago
    It's funny how the USG might be conflicted with both an interest in DNSSEC adoption, and an interest in preventing its adoption. Less than a year ago I was having DNS problems reaching a subnet in the spaceforce.mil domain (via AFRC Desktop Anywhere). After some troubleshooting, I determined that the DNS server for their subnet was not configured for DNSSEC and my client was configured to refuse unauthenticated resolvers. Everything worked fine once I turned off DNSSEC locally. DNSSEC can prevent spoofing via MITM, which is something that lots of governments do, so I can see why they might not want everyone to adopt it. On the other hand, DNSSEC can help to secure network communication, so I can see why they might want to adopt it.
    - nightpool 3y ago
      > DNSSEC can prevent spoofing via MITM, which is something that lots of governments do, so I can see why they might not want everyone to adopt it. Only if you're NOT using HTTPS, right? In which case your traffic is already trivially spoofable, so you're not really gaining anything else by using DNSSEC there.
    - tptacek 3y ago
      DNSSEC is literally a key escrow system for the North American TLDs. There's no conflict: the USG people who know what DNSSEC is want it bad.
X-Istence 3y ago
It's a requirement from some of our customers in the financial industry, as well as gov't. It's something various security firms have asked for, and it's a checkbox we will continue to just check. No matter how useless I think it is.
- tptacek 3y ago
  That's fine, I understand. I'm not telling you how to live your life. All I'll say is: there are SOC2 firms that will also tell you to turn DNSSEC on. You can tell them to go fuck themselves, and you'll be just fine. I don't know if that's the case with your NY-FI customers (none of the major investment banks are signed, nor are any of the exchanges, nor are the largest hedge funds and prop traders, but that's neither here nor there); only you know how to handle them. I'm just here to establish that the mainstream security audits definitely don't require DNSSEC. :)
  - amluto 3y ago
    The finance systems I’m familiar with generally don’t rely on DNS for security and, more commonly, don’t rely on it at all. For systems operating over the open Internet, the most common security mechanisms involve pre-shared key pairs. For systems not on Internet, IP (v4) addresses are generally used directly. I’m actually generally disappointed that TLS in the context of web browsers essentially only uses the CA system for identification and security. It’s wrong at both ends of the spectrum. There are systems where manual key distribution would be fine, and avoiding the CAs as a weak point would be beneficial. And there are systems where the CA system flat out does not work (e.g. anything where the servers are not connected to the Internet and do not even have every-few-days Internet access). Neither of these use cases are handled well by web browsers. (DNSSEC doesn’t help either, of course.)
    - bruce511 3y ago
      >> (e.g. anything where the servers are not connected to the Internet and do not even have every-few-days Internet access Actually it's possible to use the CA system on a closed LAN. A) register a domain. For example company-lan.com. B) assign each server on your Lan with a name and (local) address. Eg, daisy.company-lan.com, resolving to say 192.168.1.1 Clearly this address is only useful when used inside your lan. C) provision certificates for this address using the DNS-Challenge approach rather than the HTTP-challenge approach. (Bonus tip; using a DNS provider with a good API makes the process automateable).

donttellmypeers 3y ago

Does Route53 let you manage the DNSKEY RRset (so you can add a DNSKEY to the set yourself) or do they have some sort of facade you have to interact with instead?

X-Istence 3y ago
Route53 signs the zone itself, and the key is managed using AWS KMS.
- donttellmypeers 3y ago
  That's an answer to a different question. I asked if they let you put a DNSKEY RR in the RRset they serve. (To be clear: I'm not asking if they will import private keys and sign with them or anything like that, just if they'll let you place an additional DNSKEY in the RRset they serve.)
  - wlonkly 3y ago
    I had to add a DS record to a Route53 zone just the other day, and when I did, I didn't see a DNSKEY option in the list of records. Don't count on that 100% because I wasn't looking for it, but I definitely don't recall seeing it.
deleted 3y ago
[deleted]

adrr 3y ago

Route53 doesn't even let you add your key without making multiple entries and splitting the key.

X-Istence 3y ago
You still have the add the DS records for the hosted zones to the parent hosted zone... The key for a hosted zone is managed using AWS KMS.

hannob 3y ago

This is an argument against checkbox "audits", not an argument for DNSSEC.

jedisct1 3y ago

Even Google doesn't enable DNSSEC. In the future, ECH may become a justification for enabling it, though.