DNSSEC - ArchWiki

# DNSSEC

This article or section needs language, wiki syntax or style improvements.

Reason: More a draft than an article (Discuss in Talk:DNSSEC#)

This article is a stub.

Notes: please use the first argument of the template to provide more detailed indications. (Discuss in Talk:DNSSEC#)

## DNSSEC Packages

This article or section is a candidate for merging with DNSSEC#Howto enable DNSSEC in specific software.

Notes: Duplicated information (Discuss in Talk:DNSSEC#)

- dnssec-anchors
  - essential package contains keys to internet from IANA stored in /usr/share/dnssec-trust-anchors/
  - VERY important!
- ldns
  - DNS(SEC) library libldns
  - drill tool (like dig with DNSSEC support)
    - can be used for basic DNSSEC validation. eg.:
      - Should success (return 0):
        - drill -TD nic.cz #valid DNSSEC key
        - drill -TD google.com #not signed domain
      - Should fail (simulating fraudent DNS records):
        - drill -TD rhybar.cz
        - drill -TD badsign-a.test.dnssec-tools.org
      - to use root-zone trust anchor add option -k /usr/share/dnssec-trust-anchors/root-anchor.key
- dnssec-tools (package is very experimental and volatile right now)
  - https://www.dnssec-tools.org/
  - another good library libval which can add DNSSEC support to lots of programs
    - https://www.dnssec-tools.org/wiki/index.php/DNSSEC_Applications
  - some tools https://www.dnssec-tools.org/wiki/index.php/DNSSEC-Tools_Components
    - https://www.dnssec-tools.org/wiki/index.php/Applications
  - libval-shim LD_PRELOAD library to enable DNSSEC for lots of DNSSEC unaware programs http://www.dnssec-tools.org/docs/tool-description/libval_shim.html
  - PERL API
- sshfpAUR
  - Generates DNS SSHFP-type records from SSH public keys from public keys from a known_hosts file or from scanning the host's sshd daemon.
  - not directly related to DNSSEC, but i guess this will become very popular because of DNSSEC
- opendnssecAUR
  - Signs DNS zones to be later published by a DNS server (bind, nsd, etc.)
  - Automates refreshing signatures, key rollovers

## Howto enable DNSSEC in specific software

This article or section is a candidate for merging with DNSSEC#DNSSEC Packages.

Notes: Duplicated information (Discuss in Talk:DNSSEC#)

If you want full support of DNSSEC, you need each single application to use DNSSEC validation. It can be done using several ways:

- patches
  - https://www.dnssec-tools.org/wiki/index.php/DNSSEC_Applications
  - https://www.dnssec-tools.org/wiki/index.php/DNSSEC_Application_Development
- plugins, extensions, wrappers
- universal LD_PRELOAD wrapper
  - overriding calls to: gethostbyname(3), gethostbyaddr(3), getnameinfo(3), getaddrinfo(3), res_query(3)
  - libval-shim from dnssec-tools: http://www.dnssec-tools.org/docs/tool-description/libval_shim.html
- DNS proxy

### OpenSSH (fixes only weak point in SSH design)

- dnssec-tools + patch: https://www.dnssec-tools.org/wiki/index.php/Ssh
  - http://www.dnssec-tools.org/readme/README.ssh

### Firefox (secure browsing - enhancement of HTTPS)

- DNSSEC Validator plugin https://addons.mozilla.org/en-US/firefox/addon/64247/
- DNSSEC Drill plugin http://nlnetlabs.nl/projects/drill/drill_extension.html
  - you need ldns and dnssec-root-zone-trust-anchors packages for this plugin
- dnssec-tools + firefox patch: https://www.dnssec-tools.org/wiki/index.php/Firefox

### Chromium/Google Chrome (secure browsing - enhancement of HTTPS)

- Vote for #50874
  - Patches not yet...
  - DNSSEC Drill extension (EXPERIMENTAL!)
    - you need ldns and dnssec-root-zone-trust-anchors packages for this plugin

### BIND (serving signed DNS zones)

- See BIND for more information on BIND
- http://www.dnssec.net/practical-documents
  - http://www.cymru.com/Documents/secure-bind-template.html (configuration template!)
  - http://www.bind9.net/manuals
  - http://www.bind9.net/BIND-FAQ
- http://blog.techscrawl.com/2009/01/13/enabling-dnssec-on-bind/
- Or use an external mechanisms such as OpenDNSSEC (fully-automatic key rollover)

### Postfix (fight spam and frauds)

- dnssec-tools + patch

### jabberd (fight spam and frauds)

- dnssec-tools + patch

### Thunderbird (secure logins)

- dnssec-tools + patch

### lftp (secure downloads and logins)

- dnssec-tools + patch

### wget (secure downloads)

- dnssec-tools + patch

### proftpd

- dnssec-tools + patch

### Sendmail (fight spam and frauds)

- dnssec-tools + patch

### LibSPF

- dnssec-tools + patch

### ncftp (secure downloads and logins)

- dnssec-tools + patch

### libpurple (pidgin + finch -> secure messaging)

- no patches yet

- Vote for #12413

## DNSSEC Hardware

You can check if your router, modem, AP, etc. supports DNSSEC (many different features) using dnssec-tester (Python and GTK+ based app) to know if it is DNSSEC-compatible, and using this tool you can also upload gathered data to a server, so other users and manufacturers can be informed about compatibility of their devices and eventualy fix the firmware (they will be probably urged to do so). (Before running dnssec-tester please make sure, that you do not have any other nameservers in `/etc/resolv.conf`). You can also find the results of performed tests on the dnssec-tester website.

## See Also

- AppArmor
- Wikipedia:Domain Name System Security Extensions
- http://www.dnssec.net/
  - http://www.dnssec.net/practical-documents
  - http://www.dnssec.net/rfc
- https://www.iana.org/dnssec/
- https://www.dnssec-tools.org/
- http://linux.die.net/man/1/sshfp
- https://bugs.archlinux.org/task/20325 - [DNSSEC] Add DNS validation support to ArchLinux
- DNSSEC Visualizer

Categories:

- Encryption
- Domain Name System

Hidden categories:

- Pages or sections flagged with Template:Style
- Pages flagged with Template:Stub
- Pages or sections flagged with Template:Merge