Questions tagged [dnssec]
DNSSEC QUESTIONS MUST BE PROGRAMMING RELATED. The Domain Name System Security Extensions (DNSSEC) is a suite of specifications for securing certain kinds of information provided by the Domain Name System (DNS).
68
questions
0
votes
0
answers
11
views
DNSSEC support for Sass CMS products like Wix or Webflow
We plan to use Webflow or Wix for our product homepage. We got the requirement that our domain needs to work with DNSSEC. We keep our domain registered in AWS Route 53 and we can enabled DNSSEC in it.
...
0
votes
0
answers
20
views
DIG DS KO on server but OK on local
I’m trying to retrieve the domain DS entry for DNSSEC.
I put this code in my file :
n = dns.name.from_text(domain_name)
answers = dns.resolver.resolve(n, rdtype=dns.rdatatype.DS)
return [rdata.to_text(...
0
votes
1
answer
55
views
How to replace all lines between two comments and subtitute it with some text in sed
I have a problem that is very similar to those SO thread:
Linux: How to replace all text between two lines and substitute it with the output of a variable using sed?
how to replace all lines between ...
0
votes
0
answers
48
views
How can I make a child zone on Oracle Cloud with DNSSEC , which it apparently doesn't support?
A few years ago, I moved my domains to a registrar that supports DNSSEC for .co.uk domains when I realised that Google Cloud Platform supported DNSSEC and SSHFP records. That worked fine on GCP.
Now I ...
0
votes
1
answer
226
views
bind9 with 'dnssec-policy default;' does not update zonerecords when signing
I'm running bind9 on ubuntu 20.04, package version is 1:9.16.1-0ubuntu2.11. I've configured it to do fully automatic DNSSEC signing, using the dnssec-policy default; statement in zone configuration.
I ...
1
vote
1
answer
116
views
BIND 9 restart performance with DNSSEC
At the moment i experimenting with the restart performance of BIND9 (version 9.16.17). With 26000 active zones in the named.conf, the restart is roundabout 10 seconds. but when i start using DNSSEC, ...
-1
votes
2
answers
198
views
Edit BIND config file using PHP
I have a file called named.conf, which is the configuration file for BIND. It has entries enclosed in curly braces. I want to edit and enter a new zone entry into both the internal and external views ...
1
vote
2
answers
853
views
How do I hide dnssec keys from results when doing 'dig +trace microsoft.com'
Usually when I run dig commands, it hides the DNSSEC keys (the RRSIG, DS, and NSEC records).
Per the man page for dig, you can use this option to enable/disable DNSSEC validation:
+[no]dnssec
But ...
0
votes
0
answers
267
views
problem with script verifying RRSIGs using DNSPython
Im writing a script to verify rrsigs using dnspython but something is wrong with my code. The following is a snippet and its accompanying error message:
domain = 'iana.org'
server = '8.8.8.8'
qname = ...
0
votes
1
answer
314
views
Verifying NSEC3 records
I'm fiddling with DNSSEC, and I'd like to try to verify NSEC3 records generated by dnssec-signzone from bind9-utils (which I presume are valid). This is my zone file:
$ORIGIN dnssectest.mvolfik.tk.
$...
2
votes
2
answers
758
views
Where I can find the DNSSEC values at Google Cloud DNS? [closed]
I am looking for the DNSSEC values (Key tag, Algorithm, Digest Type, and Digest) in Google Cloud DNS so that I can create a DS record for my domain in Google Domains.
1
vote
1
answer
1k
views
What is the difference between DNS-over-HTTPS and DNSSEC?
I was just introduced to the Domain Name System Security Extensions (DNSSEC) and it sounds very similar to the concept of DNS-over-HTTPS (DoH) and DNS-over-TLS: to add privacy and security into DNS ...
0
votes
0
answers
28
views
Does DNSSEC allow a TLS shortcut?
My understanding of the TLS 1.3 protocol is that the client authenticates the server by checking the public key in the certificate sent by the server. Before a client connects, the operating system ...
0
votes
1
answer
202
views
How to find registrador of DS record
I bought a domain name magicescape.es a year ago. The issue is that this domain name has a DS record, but I didn't add it and can't delete or change. For .es domains, DNSSEC does not support. I spent ...
0
votes
0
answers
170
views
DNSSEC: After signing child zone do I need to work my way up the chain and sign every parent zone?
So working through literature and tutorials DNSSEC is fairly straight forward. I sign a zone and hand the DS records to the parent zone, which in basic tutorials is your registrar thus completing the ...
0
votes
0
answers
145
views
How to run a standalone DNSSEC root zone?
I got this white lab. It has its own top-level domain (TLD) name whitelab. and ISC Bind9 9.15 is used.
This makes it possible to rollout many network testing scenarios in-house.
How does one DNSSEC-...
0
votes
1
answer
181
views
Does Firebase Hosting provides support for DNSSEC?
Is there any support for DNSSEC for apps hosted on Firebase? According to these 2 reports not:
https://viewdns.info/dnssec/?domain=firebaseapp.com
https://viewdns.info/dnssec/?domain=web.app
5
votes
0
answers
477
views
How to get validate DNSSEC with python? [duplicate]
I have been trying for a long time to get a DNSSEC validated on Google, but every time when I tried to get it, I got some errors. For example, when I was trying on Google.com. server didn't send me ...
-1
votes
1
answer
127
views
Why salt of NSEC3 record should be made public?
I'm wondering why NSEC3 record should include salt? I can't imagine why and how resolvers use salt?
1
vote
2
answers
356
views
Creating valid RSA/SHA256 Key for DNSKEY Resource Record
I am writing DNS server on python and currently stuck with DNSKEY resource record for DNSSEC. According to RFC5702 RSA/SHA256 key components are:
Given a private key with the following values (in ...
-1
votes
1
answer
3k
views
DNS SERVFAIL Error for normal dig but no error with +trace
I've configured a new zone (IDN domain) at my authoritative DNS server, but it dosesn't work, when I try to troubleshiit using DIG command i receive "SERVFAIL"
dig.exe @8.8.8.8 xn--mgba6g.xn-...
-2
votes
1
answer
196
views
google cloud platform load balancer dns amd DNSSEC not working in US
here is my scenario:
i have build an LB on GCP (https).
Static reserved IP
DNSSEC set to on
DNS A and CNAME records
4 web servers sit behind the LB back end
front end set for https
when going via IP,...
4
votes
3
answers
937
views
How to setup DNSSEC for DNS records on AWS
Model:
I have my domain registered in provider subreg.cz and he have ability of DNSSEC.
I am pointing domain to AWS Route 53 with AWS nameservers.
Trying setup DNSSEC on DNS records.
Without any ...
1
vote
1
answer
185
views
To enable DNSSEC is it required to have namesevers set to the domain registrar?
In order to enable DNSSEC, is it required to have namesevers set to the domain registrar?
I would like to enable DNSSEC, but my domain registrar doesn't allow me to, unless the nameservers are set to ...
2
votes
2
answers
358
views
Is a DNS SRV record lookup secure?
I'm wondering how trustworthy the data from a SRV record lookup is? I have a program that essentially could fall apart if someone were to be able to spoof the SRV response.
If not, are there any ...
-1
votes
1
answer
159
views
DNSSEC Key Roll Over regarding DS record updation
Please help me to clarify my doubts,
I have a doubt regarding DNSSEC Key Roll Over.
If any specific reason to resign every domain within a time period?
If it gets resigned and regenerated KSK and ...
1
vote
1
answer
288
views
dnssec-dsfromkey showing unknown algorithm error
dsfromkey command to generate ds record with following digest types DSA/SHA1, RSA/SHA-1,DSA-NSEC3-SHA1, RSA/SHA-512, GOST R 34.10-2001 etc
I am using the following command
dnssec-dsfromkey -a ...
3
votes
0
answers
102
views
What is the correct TLSA record for the QUIC protocol?
As QUIC is based on UDP, is the following entry correct?
_443._udp.example.com. 300 IN TLSA 1 0 1 HASH...
1
vote
1
answer
4k
views
DNSSEC using dnspython error: AttributeError: 'NS' object has no attribute 'is_absolute'
I have a DNS server for (com) zone. I use BIND 9.10.3 in Ubuntu. I want to use DNSSEC for DNS queries to this server. I have created ZSK and KSK and I have a signed zone file named forward.com.signed. ...
2
votes
1
answer
149
views
co.uk. dns zone validation with DNSSEC
Long time listener, first time caller here.
I'm writing a DNS resolver with DNSSEC validation incorporated, and have noticed something that i can't really understand, after several read-throughs of ...
0
votes
0
answers
252
views
Why don't Google and CloudFlare DNS-over-HTTPS support returning the DS RRSIG for DNSSEC?
Every other field required to perform DNSSEC validation is returned by these APIs, and the API protocol formats from Google and CloudFlare are exactly the same, yet both of them specifically omit the ...
0
votes
0
answers
373
views
How to return SERVFAIL and REFUSED codes using CAA Lookup?
I'm developing the validation of the CAA (Certification Authority Authorization) records for the SSL certificates issuance, according to RFC 6884.
I would like to know how to check the FQDNs 15, 16, ...
0
votes
1
answer
362
views
Building the RDATA part of DNSKEY RR
I am in the process of finishing a Domain Registrar plugin for a billing system (which also manages domain provisioning in this case), and the last bit is related to implementing DNSSEC support.
The ...
1
vote
0
answers
5k
views
managed-keys-zone ./IN: No DNSKEY RRSIGs found for '.': success
I am running bind9 in a centos vps and started implementing dnssec so I have signed zonefiles for my domains but the following output shows up in the logfiles every hour
named[12181]: managed-keys-...
4
votes
2
answers
4k
views
How to list all DNS records including DANE TLSA
I would like to list all/any DNS records including the DANE TLSA.
With
dig mailbox.org ANY
I get all records including DNSSEC etc. but nothing about DANE. Why?
With
dig _443._tcp.mailbox.org. ...
7
votes
2
answers
583
views
Validate RRSIG with PHP using openssl
I'm trying to do a RRSIG validation, I'm trying to use the openssl lib in PHP. But I'm having a problem to pass the public key to the openssl_verify function.
This is a base code,
using the Net/DNS2 ...
2
votes
1
answer
1k
views
How to generate ECDSA private and public key for DNSSEC using OpenSSL?
I am trying to create private and public keys for DNSSEC algorithm 13:
#include <stdio.h>
#include <stdlib.h>
#include <openssl/ec.h>
#include <openssl/obj_mac.h>
#include <...
0
votes
1
answer
399
views
Why ECDSA public key generated by OpenSSL doesn't match DNSKEY generated by DNS server?
I am trying to get public key from known private key for DNSSEC algorithm 13 (ECDSAP256SHA256). I used this example: https://stackoverflow.com/a/17062076/3090865
Which modified for my key looks this:
...
21
votes
2
answers
7k
views
Amazon Route 53 DNSSEC support
We are trying to decide which DNS hosting solution to use. Today we use Power DNS and we want to move to a hosted DNS solution. The best solution for us would be using Amazon's Route 53 for this.
We ...
1
vote
2
answers
3k
views
How do I enable DNSSEC in my CPANEL or VPS
I have a .leg.br domain It's a government dns domain, in this domain it is mandatory to use dnssec, but they told me I need to configure dnssec in my server to the domain works, main question is: How ...
0
votes
0
answers
699
views
How to verify an IP address is DNSSEC-ed with dnspython?
I sent recursive DNS queries to root name servers, TLD servers, and authoritive servers for stanford.edu.
Root response:
TLD response:
Authority response:
At all 3 levels, I could see that ...
1
vote
1
answer
498
views
Do all DNS root servers and top-level-domain servers (TLD) support DNSSEC?
I know that DNSSEC has been widely implemented since 2010. For Authority name servers, it depends on the admin whether he wants to support DNSSEC or not. However, I would like to know whether or not ...
3
votes
2
answers
509
views
where and how to submit DNSSEC DS record for a IDN ccTLD
I got the opportunity to configure an IDN ccTLD.
I have already configured the DNS server and it is working properly.
Now I have a challenge to secure the dns service by DNSSEC.
I configured DNSSECC ...
0
votes
2
answers
10k
views
Mxtoobox: Loop detected! We were referred back to IP
I followed the tutorial for DNSSEC found in https://www.digitalocean.com/community/tutorials/how-to-setup-dnssec-on-an-authoritative-bind-dns-server--2
Here is my zone file:
$ORIGIN .
$TTL 86400 ...
2
votes
0
answers
518
views
Parsing Private-Key format 1.2 with Python 3
Working with DNSSEC and PowerDNS I am trying to parse a Private Key format 1.2 with Python so I can get the corresponding Public key.
Using pydnssec ( https://github.com/tomas-mazak/pydnssec ) I was ...
3
votes
1
answer
1k
views
How can I check DNSSEC compliance with nodejs?
I'm building some web analytics tools, but I'm having some difficulty checking DNSSEC compliance in a NodeJS application. None of the DNSSEC record types seem to be accepted by the dns module in the ...
4
votes
1
answer
1k
views
What is DNSSEC in a nutshell?
could anyone explain to me how the DNSSEC works in a nutshell?
What I can already understand (but i do not know if it is completely correct) is:
DNS is an old protocol created in the early Internet,...
2
votes
0
answers
79
views
How to import DNSSEC private key into BouncyCastle
I've followed the steps outlined here to generate a signed Zone file: https://www.digitalocean.com/community/tutorials/how-to-setup-dnssec-on-an-authoritative-bind-dns-server--2
In the generation of ...
2
votes
0
answers
585
views
How to correctly generate an RRSIG record for a DNSSEC response?
I am working on building a custom DNSSEC server that will respond to queries based on their subdomain. For example, queries of
abc123.example.com would respond with 0.0.0.0
def456.example.com would ...
1
vote
1
answer
377
views
How do I verify a root DNS trust anchor?
I am trying to verify root Key Signing Key (KSK) against the trust anchor (Kjqmt7v.crt) downloaded from here. I am getting root KSK using the Net::DNS module.
I am very confused at present on how to ...