bk99.de entertain the web since 1997

bk99.de
Hostblogger · DNSCurated

Making CAA records available in the DNS zone editor

Summary

At customers’ request, Manuel Schmitt adds the CAA resource record type to his hosting company’s DNS zone editor. The CAA type was enabled in the zone editor on 27 January 2017. According to the article, the extension came about at the request of many customers.

Ideas

  • CAA publishes which certificate authorities may issue certificates for a domain.
  • A DNS editor must support new record types without error-prone free-text tricks.
  • Customer requests can bring small management functions with a large security effect to light.

Insights

  • Security standards only become effective when everyday tools support them conveniently.
  • DNS management is part of certificate control and not just name resolution.

Facts

  • The article is aimed particularly at server customers.

Recommendations

  • Specify CAA only for the certificate authorities you actually use.
  • Monitor CAA errors and certificate issuance after DNS changes.

References

Read the original article on Hostblogger

Search the Web Archive

Hostblogger · 2006

Running secondary name servers across organisations

Manuel Schmitt describes a mutual secondary DNS arrangement between manitu and the Max Planck Institute in Saarbrücken. The Max Planck Institute already provided additional name servers for manitu.de and manitu.net. In return, manitu took over secondary DNS for some reverse zones.

RFC · 1987

RFC 1035: DNS messages and resource records

RFC 1035 specifies the DNS packet format, resource records and the communication between resolvers and servers. A compact binary format was crucial for global scalability. Extensions have to cope with old resolvers and limited packet sizes.

KrebsOnSecurity · 2019

DNSpionage: When the registrar becomes the attack path

Brian Krebs reconstructs an espionage campaign that manipulated registrar accounts and DNS records to intercept the email and VPN access of numerous organisations. Netnod confirmed that its registrar account had been compromised. The attackers obtained certificates for manipulated mail destinations.