4 ms·
No signature needed. Just hand out whatever you like for the entire zone. There are several exceptions to the above example. First, if "example.com" d
by jamiesonbecker 12y ago
No signature needed. Just hand out whatever you like for the entire zone.
There are several exceptions to the above example.
First, if "example.com" does not support DNSSEC, there will be no RRSIG record
in the answer and there will not be a DS record for "example.com" in the "com"
zone. If there is a DS record for "example.com", but no RRSIG record in the
reply, something is wrong and maybe a man in the middle attack is going on,
stripping the DNSSEC information and modifying the A records. Or, it could be a
broken security-oblivious name server along the way that stripped the DO flag
bit from the query or the RRSIG record from the answer. Or, it could be a
configuration error.
http://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions#Trust_anchors_and_authentication_chains http://en.wikipedia.org/wiki/Domain_Name_System_Security_Ext...
- fragmede 12y agoIf there is a DS record for "example.com", but no RRSIG record in the reply, something is wrong and maybe a man in the middle attack is going on, stripping the DNSSEC information and modifying the A records. That's the second sentence in your quote which seems to say you can't hand out whatever you like for the entire zone, given that .com and .net and .edu have all been signed since 2011.
- jamiesonbecker 12y agoRight.. check the rest of the thread above (what good is a signature that no one checks ;) )
- danyork 12y agoI agree that signatures are of no value unless validation is done... but please do note that current measurements are showing about 13% of all DNS queries globally are in fact being validated: http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=1&w=7&g=0 http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=1&w=7&g... If you scroll down that page you'll see higher statistics, such as 70% of all queries being DNSSEC-validated in Sweden, because almost all the ISPs there are now validating. In the USA, about 23% of all DNS queries are being DNSSEC-validated: http://stats.labs.apnic.net/dnssec/US?o=cXAw7x1g0r1 http://stats.labs.apnic.net/dnssec/US?o=cXAw7x1g0r1 So the argument that "no one is checking" is no longer true.
- jamiesonbecker 12y agoThat's excellent data - didn't realize those stats. Thanks for providing them.