Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Simplified problem

I want to buy a domain and make a website that is fully secured with DNSSEC.

I want to make sure that only the one right SSL certificate could be validated by the browsers and all of the rogue SSL certificates or certificates for unqualified names would be rejected.

Where can I buy a domain? Whare should I buy a certificate? (Or should I use a self-signed certificate with DNSSEC instead of CAs?) Where can I host DNS? Which providers make the whole process most convenient, most affordable, most complete, most professional, most robust, most secure?

Background

I've been hearing about the insecurity of DNS for years. I've watched all of the talks by Dan Kaminsky and others from DNS exploits to The future of DNS Security Panel. I knew that using DNS without security is a disaster waiting to happen. I followed the development of the DNSSEC standard. I celebrated the key signing ceremony.

Meanwhile I read about Thousands of SSL Certs Issued To Unqualified Names and Rogue SSL Certs Issued For CIA, MI6, Mossad and many other stories like that showing problems with the current implementation of websites secured with SSL that could be solved by DNSSEC (see: A Major Internet Milestone: DNSSEC and SSL and DNSSEC to fix the SSL mess? and SSL certificate validation and DNSSEC). Everything was on the right track to finally have a secure DNS system in place.

And now more than 2 years later I wanted to just do what everyone said I should do: use DNSSEC for a new domain. So I need a domain registrar and a DNS hosting service that supports DNSSEC. Surprisingly it is not that easy to even find out who does support DNSSEC and to what extent. It was actually much easier to find info on DNSSEC two years ago when everyone was going to support DNSSEC Real Soon Now but now years passed and I hardly see any progress done. I just hope that I was just looking in the wrong places and someone here will kindly explain all of the doubts.

I hope that other people who want to have a secure website will also find this question useful.

What is needed

  • registrar and DNS servers with full DNSSEC support for .com domains
  • integration of DNSSEC with SSL certificates

What is not needed

  • IPv6 support
  • Web hosting
  • anything more

What I found out so far

Related questions

  1. How to find web hosting that meets my requirements?
  2. What is needed to add DNSSEC to my site?
  3. DNS hosting better managed by Domain provider or Hosting provider?
  4. Registrar with good security, DNS hosting, and DNSSEC and IPv6 resolvers?

In no. 1 no one is ever mentioning DNS at all. In no. 2 answers only mention the .se TLD, there are very few answers and they seem very outdated. In no. 3 one answer says "On projects that demand higher security, I might look for a web host that supports DNSSEC" but no more information is provided.

The only relevant answers are in no. 4 where easyDNS is recommended by someone who has never used them personally. Meanwhile, as of October 2012, the support of DNSSEC is described as "in beta" on the easyDNS feature list. Another one recommends SiteGround but searching their site for DNSSEC returns no results. Other answers recommend web hosting providers that don't meet the requirement of DNSSEC support. Also the question mentioned above lists 9 very specific requirements other than only DNSSEC (like eg. HTTP-only login cookies, two-factor authentications, no DNS record limits, DNS statistics of queries/day, audit trails etc.) which might have excluded many possible recommendations if one is only interested in DNSSEC support.

Conclusions

Is it possible that the pioneer of DNSSEC adoption would be Go Daddy and all of the "expert" DNS services are not ready yet?

I thought that by the end of 2012 the support of DNSSEC among domain registrars and DNS providers would be nearly universal. I am shocked that the support seems virtually nonexistent. Is this a result of some serious problems with the DNSSEC adoption? Or is it just not a hot topic and no one bothers anymore? According to the DNSSEC Scoreboard roughly about 0.1% of .com domains support DNSSEC. Could that be caused by the lack of DNSSEC support among registrars and DNS providers, is the information too hard to find or maybe no one cares? There is even no "dnssec" tag here.

Summary

The information is surprisingly hard to find. That is why I am asking for first-hand experience and personal recommendations.

Has anyone here actually set up a website with DNSSEC, from the domain registration to the configuration of DNS servers, to actually having a working website that is fully secured with DNSSEC?

Has anyone successfully integrated DNSSEC with SSL certificates to make sure that only the one right certificate could be validated by the browser and all of the rogue SSL certificates or certificates for unqualified names would be rejected?

Can anyone recommend any of the registrars mentioned above?

Can anyone recommend any registrar not mentioned above?

Any good experience? Bad experience?

share|improve this question
    
Great question. I can't offer a personal recommendation, but this list from PIR features an up-to-date group of DNSSEC providers, some of whom aren't mentioned in your list so far. The Internet Society also has a guide on signing domains with DNSSEC with a small but growing number of registrars. –  Nick Oct 12 '12 at 10:51
    
Should have mentioned that the Internet Society's guides all mention pricing, so they're pretty useful. It seems DNSSEC is a premium service among all registrars at the moment. –  Nick Oct 12 '12 at 10:57
    
Thanks @Nick I've added the information from your links to the question. –  rsp Oct 13 '12 at 8:57
1  
This list (frankb.us/dns) of free secondary/slave servers (with indication whether they support DNSSEC) seems like a useful starting point should you decide that paying Dyn Inc. $30/month is too pricy for one or two domains, and that you just don't want to go there with GoDaddy, but would rather roll DNS services yourself with some remote backup (which is what I'll probably do for my personal domains, although I'd probably use Dyn Inc. for a commercial project). When I get it set up, I'll write up my experiences in an answer here. –  Alex Dupuy Mar 12 '13 at 21:17
add comment

2 Answers

up vote 1 down vote accepted

This website: https://pointless.net/

Is dnssec signed and uses a TLSA record (RFC6698) to secure the SSL certificate (Which is also signed by CA CERT, a sort of open source web of trust CA).

I run my own nameservers and use Easydns as my registrar - however Easydns doesn't support putting a DS record in the .net zone so I use the ISC Domain Lookaside Validation service (DLV) as the trust anchor, which is free and is used by the majority of DNSSEC validatiing resolvers. I'm also using gkg.net for some other domains and they do support doing DNSSEC properly.

Currently no web browser (as far as i'm aware) has native support for validating TLSA records however you can get a TLSA validating add-on for firefox, but it hangs on some dns lookups.

I did a talk on DNSSEC and related matters at the EMFCamp Hackercamp this summer, my notes and link dump are on the EMFCamp wiki.

P.S. If you are reading this and think DNSSEC and TLSA is a waste of time then read this paper about how the Great Firewall of China Leaks.

So to answer your summary questions:

  • yes
  • yes
  • gkg.net
  • dlv.isc.org, while it's not exactly a registrar it lets you work around registrars which don't support dnssec.
  • lessons learned:
    • If you run your own dns servers you must use some software for managing the dnssec key rollovers, I use zkt signer.
    • you can't have the same piece of DNS server software be both an authoritative server and a validating resolver - the ad and aa flags clash, I had to stop my nameserver from being a resolver, unbind it from localhost and use unbound on localhost instead.

updates:

This is a good summery of the current state of play

update 13 Dec 2012:

I'm now using gkg.net for all my domains. I'm still also using the isc dlv service, but I don't really need it anymore.

share|improve this answer
add comment

I don't have personal experience with DNSSEC so can't really make any recommendations, but this link from the ICANN site shows a list of the current registrars who have reported support for DNSSEC:

http://www.icann.org/en/news/in-focus/dnssec/deployment

share|improve this answer
    
Thanks. I've already read this list (I forgot to mention it in the question, maybe I'll add it for completeness) but the problem with this list is that the support level is completely unknown. For example Go Daddy is listed but it seems that DNSSEC is a premium feature for which you have to pay additional fees and I don't know how it works in practice. Name.com is listed, DynDNS is listed, easyDNS is listed, but see the info in my question. It's hard to find which registrars fully support DNSSEC or how convenient do they make it and that's why I'm asking about personal experience. –  rsp Oct 12 '12 at 8:46
add comment

protected by Community Apr 17 '13 at 0:55

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.