In 2010, it was an easy decision to use a commercial DNSSEC signer to deploy DNSSEC on APNIC’s reverse zones. Because much of the signer’s management was automated, we only had to worry about updating the parent delegation signer (DS) record separately.

So, even though we had to consider the scheduled Key Signing Key (KSK) rollover, updating the parent DS record on time was never an issue, since it would not roll-off the old key unless the new DS record had been updated in the parent zone.

In 2019, RFC 8624 (Algorithm Implementation Requirements and Usage Guidance for DNSSEC) was released. The minimum recommended DNSKEY algorithm changed to RSASHA256, and there was a strong recommendation to use ECDSAP256SHA256 as it provides more cryptographic strength with a shorter signature length than either RSASHA256 or RSASHA512.

RSASHA1 was APNIC’s DNSKEY algorithm for almost 10 years, so the need to upgrade was it was inevitable. When it was time to upgrade, algorithm rollover was supported and well documented.

Following the recommendations in RFC 8624, we decided to migrate APNIC’s existing DNSKEY algorithm from RSASHA1 to ECDSAP256SHA256. The whole process took about a week to complete, without breaking the DNSSEC chain of trust.

Once we’d migrated, it was great to see the new (short) signatures from our zones.

What else could we ask for?

If you’re into DNSSEC, you’ll probably have to troubleshoot or at least to verify it. While there are some good online tools such as DNSViz, there is also a command-line tool to test DNSSEC signatures onsite: delv.

This is an introductory howto to get DNSSEC running with BIND >=9.9 on Debian >=8 (jessie). We assume an "clean", freshly installed bind9 here.

This document provides introductory information on how DNSSEC works, how to configure BIND 9 to support some commonDNSSEC features, as well as some basic troubleshooting tips. The chapters are organized as such:

Chapter 1 covers the intended audience for this document, assumed background knowledge, and a basic introduction to
the topicof DNSSEC.
Chapter 2 covers various requirements that are needed before implementing DNSSEC, such as software
versions, hardwarecapacity, network requirements, and security changes.
Chapter 3 walks through setting up a validating resolver, more information on the validation process, as well as
examples ofusing tools to verify that the resolver is validating answers.
Chapter 4 walks through setting up a basic signed authoritative zone, explains the relationship with the parent zone,
and on-goingmaintenance tasks.
Chapter 5 provides some tips on how to analyze and diagnose DNSSEC-related problems.
Chapter 6 covers several topics, from key generation, key storage, key management, NSEC and NSEC3, to
disadvantages ofDNSSEC.
Chapter 7 provides several working examples of common solutions, with step-by-step details

Knot DNS 2.1 introduced support for DNSSEC signing using PKCS #11. PKCS #11 (also called Cryptoki) is a standard interface to access various Hardware Security Modules (HSM). Such devices are usually used to improve protection of private key material. The interface is rather flexible and gives the HSM vendors huge amount of freedom, which unfortunately makes its use a bit tricky. There are often surprising differences between individual implementations.

CoreDNS is a DNS server that chains middleware. Each middleware implements some DNS feature, like service discovery.

Service Discovery

CoreDNS integrates with Kubernetes via the Kubernetes middleware or directly with etcd with the etcd middleware.

Middlewares

Currently CoreDNS supports (among others) the following middlewares:

chaos: respond to CH class queries
dnssec: on-the-fly DNSSEC signing of records
etcd: SkyDNS replacement
file: serve DNS from a set of files
health: simple health check
kubernetes: use CoreDNS as a KubeDNS replacement
loadbalance: shuffle A and AAAA records
metrics: Prometheus metrics
pprof: Go profiling
proxy: forward queries to an upstream (recursive) server
rewrite: rewrite incoming queries
secondary: be a secondary nameserver and retrieve zones from a primary

"Classic" DNS fully supported

Serve DNS data from a set of files, DNSSEC signed or not.

Or just enable on-the-fly DNSSEC signing.

Straightforward DNS hosting services

Being one of leading DNS hosting providers, we always strive to provide the best possible feature set to our users. With the help of our users, we continue to improve the feature set and functionality of YDNS by adding useful features. This community driven approach makes YDNS special.

The feature set currently includes:

Unlimited hosts1 per user
Dynamic DNS for hosts, which can be used to have your home network on a permanent hostname (like example.ydns.io)
Full DNS hosting for your own domains
Backup DNS
DNSSEC2 support
A lightweight API that works with most DynDNS implementations

1 based on fair-use model, 2 DNSSEC is not available for all DNS zones

Ein Ansatz, den Schlüsselaustausch im PGP-System sicherer und für den Benutzer einfacher zu gestalten, ist der OPENPGPKEY-Draft der IETF. Mit der dort beschriebenen Methode kann der Besitzer einer E-Mailadresse den zur Adresse passenden (öffentlichen) PGP-Schlüssel im DNS veröffentlichen.