Questions tagged [dnssec]

DNSSEC QUESTIONS MUST BE PROGRAMMING RELATED. The Domain Name System Security Extensions (DNSSEC) is a suite of specifications for securing certain kinds of information provided by the Domain Name System (DNS).

Filter by
Sorted by
Tagged with
0 votes
0 answers
11 views

DNSSEC support for Sass CMS products like Wix or Webflow

We plan to use Webflow or Wix for our product homepage. We got the requirement that our domain needs to work with DNSSEC. We keep our domain registered in AWS Route 53 and we can enabled DNSSEC in it. ...
znaczek5's user avatar
0 votes
0 answers
20 views

DIG DS KO on server but OK on local

I’m trying to retrieve the domain DS entry for DNSSEC. I put this code in my file : n = dns.name.from_text(domain_name) answers = dns.resolver.resolve(n, rdtype=dns.rdatatype.DS) return [rdata.to_text(...
Hugo Dos Santos's user avatar
0 votes
1 answer
55 views

How to replace all lines between two comments and subtitute it with some text in sed

I have a problem that is very similar to those SO thread: Linux: How to replace all text between two lines and substitute it with the output of a variable using sed? how to replace all lines between ...
Wisdom's user avatar
  • 121
0 votes
0 answers
48 views

How can I make a child zone on Oracle Cloud with DNSSEC , which it apparently doesn't support?

A few years ago, I moved my domains to a registrar that supports DNSSEC for .co.uk domains when I realised that Google Cloud Platform supported DNSSEC and SSHFP records. That worked fine on GCP. Now I ...
paradroid's user avatar
  • 229
0 votes
1 answer
226 views

bind9 with 'dnssec-policy default;' does not update zonerecords when signing

I'm running bind9 on ubuntu 20.04, package version is 1:9.16.1-0ubuntu2.11. I've configured it to do fully automatic DNSSEC signing, using the dnssec-policy default; statement in zone configuration. I ...
whyscream's user avatar
  • 669
1 vote
1 answer
116 views

BIND 9 restart performance with DNSSEC

At the moment i experimenting with the restart performance of BIND9 (version 9.16.17). With 26000 active zones in the named.conf, the restart is roundabout 10 seconds. but when i start using DNSSEC, ...
Phil's user avatar
  • 11
-1 votes
2 answers
198 views

Edit BIND config file using PHP

I have a file called named.conf, which is the configuration file for BIND. It has entries enclosed in curly braces. I want to edit and enter a new zone entry into both the internal and external views ...
Akhilesh's user avatar
  • 1,243
1 vote
2 answers
853 views

How do I hide dnssec keys from results when doing 'dig +trace microsoft.com'

Usually when I run dig commands, it hides the DNSSEC keys (the RRSIG, DS, and NSEC records). Per the man page for dig, you can use this option to enable/disable DNSSEC validation: +[no]dnssec But ...
madacoda's user avatar
  • 363
0 votes
0 answers
267 views

problem with script verifying RRSIGs using DNSPython

Im writing a script to verify rrsigs using dnspython but something is wrong with my code. The following is a snippet and its accompanying error message: domain = 'iana.org' server = '8.8.8.8' qname = ...
Mnemosyne's user avatar
  • 1,162
0 votes
1 answer
314 views

Verifying NSEC3 records

I'm fiddling with DNSSEC, and I'd like to try to verify NSEC3 records generated by dnssec-signzone from bind9-utils (which I presume are valid). This is my zone file: $ORIGIN dnssectest.mvolfik.tk. $...
M. Volf's user avatar
  • 1,269
2 votes
2 answers
758 views

Where I can find the DNSSEC values at Google Cloud DNS? [closed]

I am looking for the DNSSEC values (Key tag, Algorithm, Digest Type, and Digest) in Google Cloud DNS so that I can create a DS record for my domain in Google Domains.
Mikep's user avatar
  • 21
1 vote
1 answer
1k views

What is the difference between DNS-over-HTTPS and DNSSEC?

I was just introduced to the Domain Name System Security Extensions (DNSSEC) and it sounds very similar to the concept of DNS-over-HTTPS (DoH) and DNS-over-TLS: to add privacy and security into DNS ...
MakisH's user avatar
  • 977
0 votes
0 answers
28 views

Does DNSSEC allow a TLS shortcut?

My understanding of the TLS 1.3 protocol is that the client authenticates the server by checking the public key in the certificate sent by the server. Before a client connects, the operating system ...
Witness Protection ID 44583292's user avatar
0 votes
1 answer
202 views

How to find registrador of DS record

I bought a domain name magicescape.es a year ago. The issue is that this domain name has a DS record, but I didn't add it and can't delete or change. For .es domains, DNSSEC does not support. I spent ...
Dzam's user avatar
  • 211
0 votes
0 answers
170 views

DNSSEC: After signing child zone do I need to work my way up the chain and sign every parent zone?

So working through literature and tutorials DNSSEC is fairly straight forward. I sign a zone and hand the DS records to the parent zone, which in basic tutorials is your registrar thus completing the ...
loudcrowd's user avatar
0 votes
0 answers
145 views

How to run a standalone DNSSEC root zone?

I got this white lab. It has its own top-level domain (TLD) name whitelab. and ISC Bind9 9.15 is used. This makes it possible to rollout many network testing scenarios in-house. How does one DNSSEC-...
John Greene's user avatar
  • 2,259
0 votes
1 answer
181 views

Does Firebase Hosting provides support for DNSSEC?

Is there any support for DNSSEC for apps hosted on Firebase? According to these 2 reports not: https://viewdns.info/dnssec/?domain=firebaseapp.com https://viewdns.info/dnssec/?domain=web.app
Daniel Danielecki's user avatar
5 votes
0 answers
477 views

How to get validate DNSSEC with python? [duplicate]

I have been trying for a long time to get a DNSSEC validated on Google, but every time when I tried to get it, I got some errors. For example, when I was trying on Google.com. server didn't send me ...
Guaz's user avatar
  • 193
-1 votes
1 answer
127 views

Why salt of NSEC3 record should be made public?

I'm wondering why NSEC3 record should include salt? I can't imagine why and how resolvers use salt?
user6938419's user avatar
1 vote
2 answers
356 views

Creating valid RSA/SHA256 Key for DNSKEY Resource Record

I am writing DNS server on python and currently stuck with DNSKEY resource record for DNSSEC. According to RFC5702 RSA/SHA256 key components are: Given a private key with the following values (in ...
yurzs's user avatar
  • 81
-1 votes
1 answer
3k views

DNS SERVFAIL Error for normal dig but no error with +trace

I've configured a new zone (IDN domain) at my authoritative DNS server, but it dosesn't work, when I try to troubleshiit using DIG command i receive "SERVFAIL" dig.exe @8.8.8.8 xn--mgba6g.xn-...
refra's user avatar
  • 1
-2 votes
1 answer
196 views

google cloud platform load balancer dns amd DNSSEC not working in US

here is my scenario: i have build an LB on GCP (https). Static reserved IP DNSSEC set to on DNS A and CNAME records 4 web servers sit behind the LB back end front end set for https when going via IP,...
Meir Miyara's user avatar
4 votes
3 answers
937 views

How to setup DNSSEC for DNS records on AWS

Model: I have my domain registered in provider subreg.cz and he have ability of DNSSEC. I am pointing domain to AWS Route 53 with AWS nameservers. Trying setup DNSSEC on DNS records. Without any ...
Maximi's user avatar
  • 559
1 vote
1 answer
185 views

To enable DNSSEC is it required to have namesevers set to the domain registrar?

In order to enable DNSSEC, is it required to have namesevers set to the domain registrar? I would like to enable DNSSEC, but my domain registrar doesn't allow me to, unless the nameservers are set to ...
bart's user avatar
  • 15k
2 votes
2 answers
358 views

Is a DNS SRV record lookup secure?

I'm wondering how trustworthy the data from a SRV record lookup is? I have a program that essentially could fall apart if someone were to be able to spoof the SRV response. If not, are there any ...
Lane Wagner's user avatar
-1 votes
1 answer
159 views

DNSSEC Key Roll Over regarding DS record updation

Please help me to clarify my doubts, I have a doubt regarding DNSSEC Key Roll Over. If any specific reason to resign every domain within a time period? If it gets resigned and regenerated KSK and ...
Amal P Ramesh's user avatar
1 vote
1 answer
288 views

dnssec-dsfromkey showing unknown algorithm error

dsfromkey command to generate ds record with following digest types DSA/SHA1, RSA/SHA-1,DSA-NSEC3-SHA1, RSA/SHA-512, GOST R 34.10-2001 etc I am using the following command dnssec-dsfromkey -a ...
nidhin's user avatar
  • 359
3 votes
0 answers
102 views

What is the correct TLSA record for the QUIC protocol?

As QUIC is based on UDP, is the following entry correct? _443._udp.example.com. 300 IN TLSA 1 0 1 HASH...
duxsco's user avatar
  • 331
1 vote
1 answer
4k views

DNSSEC using dnspython error: AttributeError: 'NS' object has no attribute 'is_absolute'

I have a DNS server for (com) zone. I use BIND 9.10.3 in Ubuntu. I want to use DNSSEC for DNS queries to this server. I have created ZSK and KSK and I have a signed zone file named forward.com.signed. ...
user9371654's user avatar
  • 2,190
2 votes
1 answer
149 views

co.uk. dns zone validation with DNSSEC

Long time listener, first time caller here. I'm writing a DNS resolver with DNSSEC validation incorporated, and have noticed something that i can't really understand, after several read-throughs of ...
Johnny Credit's user avatar
0 votes
0 answers
252 views

Why don't Google and CloudFlare DNS-over-HTTPS support returning the DS RRSIG for DNSSEC?

Every other field required to perform DNSSEC validation is returned by these APIs, and the API protocol formats from Google and CloudFlare are exactly the same, yet both of them specifically omit the ...
Paul Shapiro's user avatar
0 votes
0 answers
373 views

How to return SERVFAIL and REFUSED codes using CAA Lookup?

I'm developing the validation of the CAA (Certification Authority Authorization) records for the SSL certificates issuance, according to RFC 6884. I would like to know how to check the FQDNs 15, 16, ...
Cristiana da Costa's user avatar
0 votes
1 answer
362 views

Building the RDATA part of DNSKEY RR

I am in the process of finishing a Domain Registrar plugin for a billing system (which also manages domain provisioning in this case), and the last bit is related to implementing DNSSEC support. The ...
Carmageddon's user avatar
  • 2,627
1 vote
0 answers
5k views

managed-keys-zone ./IN: No DNSKEY RRSIGs found for '.': success

I am running bind9 in a centos vps and started implementing dnssec so I have signed zonefiles for my domains but the following output shows up in the logfiles every hour named[12181]: managed-keys-...
Paul Nemeth's user avatar
4 votes
2 answers
4k views

How to list all DNS records including DANE TLSA

I would like to list all/any DNS records including the DANE TLSA. With dig mailbox.org ANY I get all records including DNSSEC etc. but nothing about DANE. Why? With dig _443._tcp.mailbox.org. ...
FelixF's user avatar
  • 41
7 votes
2 answers
583 views

Validate RRSIG with PHP using openssl

I'm trying to do a RRSIG validation, I'm trying to use the openssl lib in PHP. But I'm having a problem to pass the public key to the openssl_verify function. This is a base code, using the Net/DNS2 ...
Rabin's user avatar
  • 826
2 votes
1 answer
1k views

How to generate ECDSA private and public key for DNSSEC using OpenSSL?

I am trying to create private and public keys for DNSSEC algorithm 13: #include <stdio.h> #include <stdlib.h> #include <openssl/ec.h> #include <openssl/obj_mac.h> #include <...
Oleg G's user avatar
  • 925
0 votes
1 answer
399 views

Why ECDSA public key generated by OpenSSL doesn't match DNSKEY generated by DNS server?

I am trying to get public key from known private key for DNSSEC algorithm 13 (ECDSAP256SHA256). I used this example: https://stackoverflow.com/a/17062076/3090865 Which modified for my key looks this: ...
Oleg G's user avatar
  • 925
21 votes
2 answers
7k views

Amazon Route 53 DNSSEC support

We are trying to decide which DNS hosting solution to use. Today we use Power DNS and we want to move to a hosted DNS solution. The best solution for us would be using Amazon's Route 53 for this. We ...
royeet's user avatar
  • 829
1 vote
2 answers
3k views

How do I enable DNSSEC in my CPANEL or VPS

I have a .leg.br domain It's a government dns domain, in this domain it is mandatory to use dnssec, but they told me I need to configure dnssec in my server to the domain works, main question is: How ...
Otávio Barreto's user avatar
0 votes
0 answers
699 views

How to verify an IP address is DNSSEC-ed with dnspython?

I sent recursive DNS queries to root name servers, TLD servers, and authoritive servers for stanford.edu. Root response: TLD response: Authority response: At all 3 levels, I could see that ...
weefwefwqg3's user avatar
1 vote
1 answer
498 views

Do all DNS root servers and top-level-domain servers (TLD) support DNSSEC?

I know that DNSSEC has been widely implemented since 2010. For Authority name servers, it depends on the admin whether he wants to support DNSSEC or not. However, I would like to know whether or not ...
weefwefwqg3's user avatar
3 votes
2 answers
509 views

where and how to submit DNSSEC DS record for a IDN ccTLD

I got the opportunity to configure an IDN ccTLD. I have already configured the DNS server and it is working properly. Now I have a challenge to secure the dns service by DNSSEC. I configured DNSSECC ...
Samrat's user avatar
  • 83
0 votes
2 answers
10k views

Mxtoobox: Loop detected! We were referred back to IP

I followed the tutorial for DNSSEC found in https://www.digitalocean.com/community/tutorials/how-to-setup-dnssec-on-an-authoritative-bind-dns-server--2 Here is my zone file: $ORIGIN . $TTL 86400 ...
André Moreira's user avatar
2 votes
0 answers
518 views

Parsing Private-Key format 1.2 with Python 3

Working with DNSSEC and PowerDNS I am trying to parse a Private Key format 1.2 with Python so I can get the corresponding Public key. Using pydnssec ( https://github.com/tomas-mazak/pydnssec ) I was ...
Wido den Hollander's user avatar
3 votes
1 answer
1k views

How can I check DNSSEC compliance with nodejs?

I'm building some web analytics tools, but I'm having some difficulty checking DNSSEC compliance in a NodeJS application. None of the DNSSEC record types seem to be accepted by the dns module in the ...
Isaac's user avatar
  • 1,381
4 votes
1 answer
1k views

What is DNSSEC in a nutshell?

could anyone explain to me how the DNSSEC works in a nutshell? What I can already understand (but i do not know if it is completely correct) is: DNS is an old protocol created in the early Internet,...
Takeiji's user avatar
  • 51
2 votes
0 answers
79 views

How to import DNSSEC private key into BouncyCastle

I've followed the steps outlined here to generate a signed Zone file: https://www.digitalocean.com/community/tutorials/how-to-setup-dnssec-on-an-authoritative-bind-dns-server--2 In the generation of ...
JBStevens6's user avatar
2 votes
0 answers
585 views

How to correctly generate an RRSIG record for a DNSSEC response?

I am working on building a custom DNSSEC server that will respond to queries based on their subdomain. For example, queries of abc123.example.com would respond with 0.0.0.0 def456.example.com would ...
JBStevens6's user avatar
1 vote
1 answer
377 views

How do I verify a root DNS trust anchor?

I am trying to verify root Key Signing Key (KSK) against the trust anchor (Kjqmt7v.crt) downloaded from here. I am getting root KSK using the Net::DNS module. I am very confused at present on how to ...
shivams's user avatar
  • 2,597