1 DNSSEC for the.edu Domain Becky Granger Director, Information Technology and Member Services EDUCAUSE April 29, 2010

2 Agenda  Review DNS  How DNSSEC augments DNS  What DNSSEC doesn’t do  Why DNSSEC matters to you  DNSSEC Adoption  Getting started: Between now and July 2010  Going live: Anticipated in July 2010

3 DNS: A Review Illustration courtesy of Niranjan Kunwar / Nirlog.comNiranjan Kunwar / Nirlog.com

4 DNS Caching  DNS Servers cache data to improve performance  But…what happens if the cached data is wrong?

5 DNS is Fundamentally Flawed More detailed explanation:

6 DNS Cache Poisoning Gets Easier Article explaining vulnerability: by Dave Bullock / eecueDave Bullock / eecue

7 DNSSEC: DNS Security Extensions  Validate the origin of a DNS response  Trust that the data came from the expected source  Validate the integrity of a DNS response  Trust that the data itself is correct  Validate denial of existence  Trust a “no records to return” response

8 DNS with DNSSEC implemented Illustration courtesy of Niranjan Kunwar / Nirlog.comNiranjan Kunwar / Nirlog.com

9 DNSSEC Augments DNS  Use public key cryptography to “sign” DNS data  New DNS resource records carry signatures  DNSKEY, RRSIG, NSEC, DS  Publish signatures to parent zone  Domain to namespace, namespace to root  DNS resolvers validate signature matches Good explanation:

10 What DNSSEC Doesn’t Do  Encrypt data – that’s SSL  Protect your servers from denial of service attacks  Keep you from visiting phishing sites  DNSSEC protects you from forged DNS data

11 Why You Care: Hypothetical Case Study Photo by Bart EversonBart Everson

12 DNSSEC Adoption

13 Adoption is Critical  Can’t require validation yet – would reject most internet traffic  In the interim, will need a browser warning for non-validated lookups (like SSL “lock” today)  Validation will likely be required at some point

14 Adoption is Increasing Quickly Data from SecSpider: courtesy of Eric Osterweil

15 Many Top Level Domains are Signing  Signed TLDs  bg, br, ch, cz, li, lk, na, nu, pm, pr, pt, se, th, tm, uk, us  arpa, gov, museum, org  Coming soon  edu anticipated in July 2010  net anticipated in late 2010  com anticipated in early 2011 TLD data courtesy of Shinkuro, Inc.Shinkuro, Inc.

16 Current DNSSEC Adoption in.edu  7 signed.edu domains  berkeley.edu, merit.edu, penn.edu, psc.edu, upenn.edu, internet2.edu, ucaid.edu  64 signed.edu sub-domains  Many are computer science departments or DNS research projects Data from SecSpider: courtesy of Shumon Huque, University of Pennsylvania

17 Getting Started: Between now and July 1, 2010

18 If you are…  CIO or IT leader  Get DNSSEC on your staff’s radar now  Add DNSSEC to your summer maintenance schedule  Technical staff  If an ISP hosts your DNS  Ask the ISP when they will support DNSSEC  If you host your DNS  Learn about signing  Get DNSSEC-aware DNS software  Sign your zone

19 Learn About Signing  Study the RFCs  RFC 4033 – DNSSEC introduction and requirements RFC 4033  RFC 4034 – Resource records for DNSSEC RFC 4034  RFC 4641 – DNSSEC operational practices RFC 4641  NIST Secure DNS Deployment GuideSecure DNS Deployment Guide

20 Get DNSSEC-aware DNS Software  Need DNSSEC-aware software on published DNS servers and all intermediate resolvers  BIND 9.6 or greater  ZKT  OpenDNSSEC  Windows 2008 Server R2  Signing appliances  Many more… Find these packages and more at

21 Sign Your Zone  Generate a KSK and one or more ZSKs   Practice key rollovers & establish processes for managing keys 

22 Going Live: July 2010 (anticipated)

23 Chain of Trust Can Be Established Original illustration courtesy of Niranjan Kunwar / Nirlog.comNiranjan Kunwar / Nirlog.com

24 Publish Your Signatures to.edu Zone  Enter DS record data into the.edu Domain Administration website.edu Domain Administration website:

25 Many Resources Available to Help You  RFCs   DNSSEC.NET website   Your.edu colleagues – subscribe to EDUCAUSE DNSSEC deployment listserv 

26 Questions?