Collaborate Disseminate
A review of controls and associated risks identified a use case for DNS deprovisioning procedures. Specifically, an A record was not cleaned up and the domain has embedded the organization’s name.
Upon review, there are security concerns t… Continue reading Security Risks of Unprovisioned DNS Records
While I was debugging something, I noticed that none of Google’s products domains (google.com, gmail.com, googleapis.com, gstatic.com…) are DNSSEC-signed.
It seems that Google offer an unofficial DNSSEC-signed MX records for their Google W… Continue reading Why aren’t any Google’s domains DNSSEC signed?
My question relates to DNSSEC and how to check it easily when navigating the web.
DNSSEC is used by a majority of TLDs and CC TLDs, and it contributes to secure the DNS protocol.
Statistics about TLDs’ usage of DNSSEC (09-2024)
https://it… Continue reading Resources to easily check DNSSEC in Web communications – any web extentions in EU / NA?
BIND (Berkeley Internet Name Domain) is an open-source DNS software system with an authoritative server, a recursive resolver, and related utilities. BIND 9.20, a stable branch suitable for production use, has been released. According to the current so… Continue reading BIND 9.20 released: Enhanced DNSSEC support, application infrastructure improvements
I just watched a video on DNS that explained that if there is a man-in-the-middle or if someone has taken over your resolver, DNSSEC can prevent the responses from being tampered with because the client can verify that the owner of the zon… Continue reading Does DNSSEC prevent man-in-the-middle at all? [duplicate]
Say a citizen-run journalist site is a target of a hostile government. The site is hosted over HTTPS in a different country, outside the government’s reach. However, the site domain name is within the country’s top level domain.
I think … Continue reading Most likely route to hostile domain take-over?
I am trying to understand NSEC3 record when querying for existing domain name, for NXDOMAIN I understand how it works. RFC has example about WildCard, NODATA & NXDOMAIN
So I fired these queries using dig for google and netflix
and not… Continue reading Understanding DNSSEC NSEC3 output for valid domain name
I manage a few dozen servers that are publicly accessible and must remain so. I see very large volumes of malicious traffic on all of these servers. The malicious traffic starts as port scans (identified by scanlogd) and progresses to a co… Continue reading Is there a way to use DNS to block access to my domain?
I’m learning about DNSSEC today but I don’t quite understand about how a parent zone would store all of its child’s Key Signing Keys (DNSKEY 257) in its DS record set.
As far as I understand, if I have a subdomain, say, subdomain.icann.org… Continue reading Since the DS recordset contains all of the child’s Key Signing Key, wouldn’t the DS recordset be massive and difficult to load for verification?
Consider the following dig command and its truncated output:
dig . dnskey +dnssec +multi @a.root-servers.net
…
…
;; ANSWER SECTION:
. 172800 IN DNSKEY 257 3 8 (
AwEAAaz/tAm8yTn4Mfeh… Continue reading How can I validate the root DNS key-signing-key on the command line?