bk99.de entertain the web since 1997

bk99.de
RFC · DNSSECStandard explained

RFC 4033: DNSSEC: Authenticated DNS data

Summary

RFC 4033 introduces DNSSEC and explains the chain of trust, signed answers and validating resolvers. DNSSEC protects data origin, not confidentiality. Key and delegation operations decide its practical reliability.

Ideas

  • Zones sign resource records cryptographically.
  • DS records link the chain of trust across delegations.
  • Validators distinguish between secure, insecure and bogus answers.

Facts

  • RFC 4033 replaces RFC 2535.

Remarks

  • RFC 4033 has the status “Proposed Standard”; current errata and successor documents should also be checked.

Recommendations

  • Automate signing and monitor expiry times.
  • Test DS changes end to end before key rollovers.

References

Read the RFC at the RFC Editor

Search the Web Archive

RFC · 2012

RFC 6698: DANE: Binding TLS keys via DNSSEC

RFC 6698 introduces TLSA records with which DNSSEC-secured domains name certificates or keys for TLS. DANE partly moves trust decisions into the DNS hierarchy. Additional trust paths increase both options and operational responsibility.

Lutz Donnerhacke · 2017

DirectAccess breaks DNSSEC

In the lab, Lutz Donnerhacke shows how DirectAccess, DNS64 and policy-based name resolution can prevent valid DNSSEC checks. DNSSEC initially recognised the answer altered by DNS64 as insecure. The test distributed trust anchors and validation policies via group policy.

RFC · 2024

RFC 9535: JSONPath: Queries for JSON documents

RFC 9535 standardises JSONPath as a language for selecting values within nested JSON data. Standardised query languages improve portability between tools. Flexible paths need limits against expensive evaluation.