DNS is one of the oldest but also one of the most important network protocols we have and actively use. Dan Kaminsky discovered 2008 some serious flaws in DNS which is very well explained on this site. DNSsec is supposed to solve those problems.
Why don’t we have it worldwide yet?
DNSsec uses a chain of trust and signed records. There are some problems with DNSsec too. One problem, for example, is that it doesn’t protect against attacks from the governments. In conjunction with DANE, which could be a replacement for the existing Certificate-Authorities, DNSsec could make things worser than it was before. Another problem is that the records might get bigger and this makes it easier for attackers to abuse the dns-servers for ddos-attacks. In order to keep the records smaller, some DNS-servers use elliptic curve-algorithms. But elliptic curve-algorithms aren’t supported widely and many tools still don’t support records that are signed with elliptic curve-algorithms.
It’s easy to monitor, right?
Talking about tools brings me to another thing that bothers me: there aren’t much solid tools that work properly out there for Dnssec. It was very hard to find some monitoringtools or libraries that check if the Domain is signed correctly and when the keys do expire. I won’t say that there are none, but it seems that there are a lot of broken tools out there. There are many reasons for that. Those tools have to speak DNS, DNSsec and all it’s cryptographic algorithms. Some tools are old and don’t compile anymore, or have weird dependencies. Some don’t speak DNSsec directly and just utilize unbound. And some speak DNS and DNSsec but not with elliptic curve algorithms. I hope this situation changes soon.
Providers are familiar with DNSsec, right?
When I was activating DNSsec on my domain, I had to interact with my domain-provider. I realized that this provider has no standard procedure for DNSsec yet. There was no secure way to hand him over my keys(or hashes). That made me curious about the state of DNSsec in austrian companies. And I figured out that not many companies use DNSsec. Neither the biggest internet service providers nor the local banks have implemented DNSsec yet. I guess they might do that, as soon as Google starts using DNSsec(if it happens).
So why bother after all?
There are a couple of dns-records which solve some existing problems but require trusted domains. One of them is DANE/TLSA. Even if many SMTP-servers support TLS now, it still is opportunistic and they are vulnerable against Man-In-The-Middle-attacks. If people would have a trusted dns-zone, they could store the certificates(or fingerprints) as DNS-records and the other mailservers could validate the certificates. I believe this could be a good thing(as long as we trust the keys of the top-level domains). Since “email made in germany” has failed many german mail-provider(like web.de and gmx) use DANE. That’s why I decided to give DNSsec a try.
