Plan for enabling DNSSEC on BitFolk's resolvers

Hi, TL;DR ----- DNSSEC validation will be enabled on BitFolk's resolvers on Monday 29th April. The Plan -------- After consultation¹, we've come up with a plan for enabling DNSSEC validation on BitFolk's resolvers: 0. As of Wednesday 27th a test resolver has been available on 85.119.80.243, with validation enabled. You can either query through it directly, e.g.: dig -t a www.dnssec-failed.org @85.119.80.243 dig -t test.dnssec-or-not.net @85.119.80.243 or replace all IPs in your /etc/resolv.conf to send all your DNS queries through it. 1. Sometime on Saturday 30th March (tomorrow) we'll enable Unbound's "permissive mode" which performs validation and logs errors but always passes answers back to clients anyway: http://unbound.net/documentation/howto_turnoff_dnssec.html Note that this can give the impression that DNSSEC is in use, but it is strictly for testing and you are achieving no security benefit while this setting is in effect. 2. Around Saturday 6th April we'll review the logs to see what sort of impact real validation will have. We will not be examining each and every failure and we will not be providing per-customer details; it is your responsibility to make use of the test resolver if you wish to test your own queries. 3. Provided the results of stage 2 are not too shocking, validation will be switched on sometime on Monday 29th April, deliberately a working day so that those of you using your VPSes for business purposes will hopefully be around to spot any issues in the unlikely event of anything breaking. Frequently Asked Questions -------------------------- - What is DNSSEC? DNSSEC is a means by which DNS domain owners can digitally sign records in their zones, so that DNS resolvers can check that the answers they are receiving have not been tampered with at any stage. Aside from routine mangling of DNS responses done by local resolvers not under your control (think: the built-in DNS resolver in the access point of your hotel, or an ISP resolver that for some reason is set to monetise particular kinds of queries), there are other threats such as the hijacking for DNS for popular or critical sites. Additionally, digital signing of zone content is needed before you can trust other secure data that might be stored in the DNS such as cryptographic public keys, e.g. SSH host keys and DANE data. RFC 3833 - Threat Analysis of the Domain Name System (DNS): http://tools.ietf.org/html/rfc3833 If a DNS zone is DNSSEC-signed but the signatures fail validation, the query will typically fail with a SERVFAIL response instead of the expected answer. - Do I need to do anything? No; validation is configured in the resolver, and BitFolk runs the resolvers that are listed by default in your /etc/resolv.conf. More and more resolvers will start enabling DNSSEC so you may like to test it out for yourself ahead of time though. - I'm running a DNS server on my VPS for my domain. Do I need to change anything? No; this is about the DNS resolvers you use which are defined in your /etc/resolv.conf, not any DNS server you might be running to serve authoritative DNS data. Whether or not you enable DNSSEC signing for your domain is a separate (and more complicated) issue. - Does this mean bitfolk.com will be DNSSEC-signed? No; having resolvers that validate DNSSEC signatures is a necessary first step before we can consider DNSSEC-signing bitfolk.com and bitfolk.co.uk. - Am I secure as soon as this is enabled? Only if the domains you query have enabled DNSSEC. And only for the things that DNSSEC actually protects you against. If you have any further questions about any of this, please do reply here or contact us off-list at support(a)bitfolk.com. Cheers, Andy ¹ Thread on users list starts here: http://lists.bitfolk.com/lurker/message/20130326.230706.21113786.en.html -- http://bitfolk.com/ -- No-nonsense VPS hosting Has Jurassic Park taught us nothing? — pfilandr