4 ms·

Can one of you knowledgable HNers tell me how I, as a dude who owns some domains and occasionally uses DNS to point them somewhere can get on board with this?

• blumentopf 13y ago
  Your zones need to be either online-signed by the authoritative DNS servers for these zones or offline-signed (using e.g. OpenDNSSEC) and then pushed to the authoritative DNS servers. Offline-signing is obviously more secure but signatures need to be refreshed regularly, so it's not sufficient to sign the zone once and be done with it. The zone needs to be resigned and pushed out to the authoritative DNS servers continually. If that process fails somehow, the signatures will expire and your zones will no longer validate. It's like a self-inflicted DoS. Setting this up properly is a nightmare. The ISP you're hosting your domains at needs to support this.
• zimbatm 13y ago
  Similarly, is there a list of the TLDs that do support DNSSEC ?
  • fuqua 13y ago
    This is the right question. ICANN likes to put out these happy press releases, but they don't give us the details. It's necessary to name and shame the TLDs that are behind the curve.
  • fcambus 13y ago
    ICANN publishes the TLD DNSSEC Report : http://stats.research.icann.org/dns/tld_report/ http://stats.research.icann.org/dns/tld_report/ For ccTLDs only, there is this list : http://www.statdns.com/cctlds/ http://www.statdns.com/cctlds/
• nly 13y ago
  Your domain registrar needs to support it, as they need to push your keys upstream. I currently use Gandi, who do support DNSSEC in their web interface. I think Namecheap support it but you have to email them to get it setup. You need to run your own DNS server (this is really the whole point of DNSSEC!), and setting it up is an absolute dog atm.
  • slug 13y ago
    Setting up is actually fairly easy using bind and the right tools if you are familiar with DNS configuration. On debian/ubuntu there's a package for it ( dnssec-tools ). Here's a simple tutorial: http://www.howtoforge.com/configuring-dnssec-on-bind9-9.7.3-on-debian-squeeze-ubuntu-11.10 http://www.howtoforge.com/configuring-dnssec-on-bind9-9.7.3-...
• tptacek 13y ago
  If you were my client and asked me this, I would probably suggest you wait. My personal guess is that any effort you sink to deploying DNSSEC is going to be wasted, not in the sense that "DNSSEC will have bugs" (though it will), but in the sense of "the world is not going to end up using DNSSEC". In the immediacy, you should know that deploying DNSSEC isn't going to do anything for the security of your site, nor is it going to make it more reliable for computers around the world to reach your site.