6

Since the root of the DNS tree has been signed, how do I change my caching DNS server to start validating DNSSEC signatures?

Improve this question

2 Answers 2

Reset to default
5

Install and set up your nameserver (bind9 package) normally, and then just add the following stanza to /etc/bind/named.conf.options:

managed-keys {
  "." initial-key 257 3 8
    "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF
     FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX
     bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD
     X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz
     W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS
     Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq
     QxA+Uk1ihz0=";
};

Then restart the service (sudo service bind9 restart).

To make sure it is working, try to resolve "www.dnssec-failed.org", it should fail:

$ host www.dnssec-failed.org
Host www.dnssec-failed.org not found: 3(NXDOMAIN)

If it gives an IP address, then DNSSEC validation is not working.

Improve this answer
2
  • Thanks. In what release is/was this done by default in Ubuntu?
    – nealmcb
    Aug 3, 2011 at 23:25
  • The Debian instructions also say to add this to the options file: "dnssec-validation yes;"
    – nealmcb
    Aug 4, 2011 at 23:09
2

You have a choice of at least two possible caching nameservers: bind9 and unbound.

Instructions on configuring and testing each of them with the current root key (first created in July of 2010) are in the Debian wiki:

You should be careful to validate the actual key that you add to the configuration, and not e.g. trust what you might find in a web site that doesn't use SSL (https) or that doesn't have secure management of its content. E.g. posting the actual key here is probably not wise, and it can change over time at any rate. The advice at the unbound site for "unbound-anchor" looks good, and when that command is securely available as part of an Ubuntu release it looks like that will be a good option. It looks like that has been enabled since unbound version 1.4.9-1 and is currently part of the Oneric release. See more at Debian bug #594911.

For bind9, follow Bug #782614 in bind9 (Ubuntu): “make configuring DNSSEC validation easier” for progress on making this process easier. It would seem to make sense to actually include the current key as part of the Ubuntu packaging of bind9, or add some sort of update mechanism like unbound-anchor, for the convenience and protection of the users.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .