6

What is needed to add DNSSEC to my site?

Is it like HTTPS/SSL that I have to buy a certificate, or can I generate one myself to use? Is there any free way I can use DNSSEC or do I have to pay for this service? E.g if I set up my own DNS servers, or if there is any free nameservers with DNSSEC.

If I use my web hosts nameservers, I can buy DNSSEC from them for $9 per year.

Improve this question

3 Answers 3

Reset to default
3

There are two separate elements to make DNSSEC work.

  1. Generate keys and sign the DNS records.
  2. Put the hash of the key in your parent zone (.se for example.se) via the DS record.

The latter is possible with .se and a growing number of other TLDs (refer to DNSSEC deployment on wikipedia or subscribe to the dnssec-deployment mailing list).

In regards to the DIY part of the question: there are quite a few ways to implement DNSSEC for your zone. Current DNS servers already come with DNSSEC support, but still, you have to do the above steps. If you really want to do it yourself, you can use the Bind Tools (keygen and signzone) or something like the OpenDNSSEC suite.

There are also some providers that offer DNSSEC in their portfolio, but usually you will have to transfer your domain to them or use something like DNSSEC in the middle. You might want to have a look at the recently published Phreebird by Kaminsky which sits right in front of your normal DNS server and performs signing. I would recommend exanames which is designed to do as much of the work related to DNSSEC as possible, but I am biased, because I am one of the developers.

Improve this answer
1

After some more research I have found an answer.

DNSSEC protects against DNS cache poisoning. See About the Kaminsky bug for more information.

DNSSEC seems to be an extra service provided by the registrars. At least for .se I haven't found anything about other top domains.

From DNSSEC – The path to a secure domain:

Today, .SE’s DNSSEC service is an addition offered by many registrars (i.e. resellers of domain names). It is the only way to get a secure domain that cannot be subject to attacks where the answers to DNS queries are falsified. Are you interested in securing your own web and e-mail address, please turn to your registrar for more information. If you are unsure whether or not your domain is using DNSSEC, you can easily find out completely free of charge at http://www.kaminskybug.se/.

Improve this answer
1
  • 1
    That's really sad that the .se registrars have taken to abusing this protocol (originally intended as an architectural fix) as a new means of fear-mongering to make money. But if you use the testing tool on that site, you'll find that most domains are not currently vulnerable to the Kaminsky bug, and not because the domain owners all went and bought a "DNSSEC certificate."
    – Lèse majesté
    Nov 4, 2010 at 21:04
0

If you don't know what DNSSEC is, then it probably doesn't apply to you. It's something that people running DNS servers have to implement. So that means your webhost and your ISP and your users' ISPs. If they haven't already deployed DNSSEC, then there's not much you can do about it.

Improve this answer
8
  • 2
    This is like saying "If you don't know HTTPS, it's not for you" and that is very false. Even if DNSSEC is implemented on the DNS server it doesn't mean that your domain is secured with DNSSEC. It is provided as an extra service.
    – Jonas
    Nov 4, 2010 at 8:51
  • 1
    It's not an add-on service... It wouldn't even make sense to sell DNSSEC as an add-on service. Either a webhost has DNSSEC implemented on their nameservers or they don't. If they did, then every domain would benefit from DNSSEC. If they don't, then there's no way to add DNSSEC to a single domain.
    – Lèse majesté
    Nov 4, 2010 at 11:17
  • 1
    I can't read Swedish, and Google won't translate HTTPS pages, so I don't know what that page says, but DNSSEC is a way to authenticate DNS information passed between nameservers and resolvers. It wouldn't make sense for domain owners to purchase a certificate for DNSSEC. All DNSSEC says is that "this DNS record is coming from the right server." It doesn't ensure that the website at that domain name is representing itself correctly. That's why DNSSEC employs zone-based signing.
    – Lèse majesté
    Nov 4, 2010 at 13:55
  • 3
    And there's actually a lot of talk about CAs like VeriSign being made obsolete because with DNSSEC you can use self-signed SSL certificates that are verified by your DNS records.
    – Lèse majesté
    Nov 4, 2010 at 13:58
  • 1
    It's not applied per domain. All of my domains are safe from the Kaminsky bug, but I have not purchased any extra service from my host or registrar. It's something that registrars ought to consider implementing for the sake of securing their nameservers.
    – Lèse majesté
    Nov 4, 2010 at 21:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.