summaryrefslogtreecommitdiffstats
path: root/content/posts/2016-04-04-dnssec.md
diff options
context:
space:
mode:
authorTomasz Kramkowski <tk@the-tk.com>2018-07-18 23:46:06 +0100
committerTomasz Kramkowski <tk@the-tk.com>2018-07-18 23:55:42 +0100
commitc34ae6fed8503c6f8b27b4bd55cf26bb3f47ad23 (patch)
treea50e1f923f5101846e440fba4b076b14d8ac6b4b /content/posts/2016-04-04-dnssec.md
downloadthe-tk.com-c34ae6fed8503c6f8b27b4bd55cf26bb3f47ad23.tar.gz
the-tk.com-c34ae6fed8503c6f8b27b4bd55cf26bb3f47ad23.tar.xz
the-tk.com-c34ae6fed8503c6f8b27b4bd55cf26bb3f47ad23.zip
init commit
Diffstat (limited to 'content/posts/2016-04-04-dnssec.md')
-rw-r--r--content/posts/2016-04-04-dnssec.md25
1 files changed, 25 insertions, 0 deletions
diff --git a/content/posts/2016-04-04-dnssec.md b/content/posts/2016-04-04-dnssec.md
new file mode 100644
index 0000000..13c1d60
--- /dev/null
+++ b/content/posts/2016-04-04-dnssec.md
@@ -0,0 +1,25 @@
+$title "DNSSEC"
+$tags information DNS DNSSEC
+
+As of today my domain finally supports DNSSEC. It was much simpler than I
+thought it would be. It seems namecheap now officially allows you to publish DS
+records in the parent zone of your domain (limited only to TLDs which support
+it). This is one of the last things that I wanted to set up on my server.
+
+$pre
+
+In the end, the process was made very simple by the existence of
+[this][cheatsheet] which details exactly how to set up DNSSEC on BIND 9.10 or
+higher.
+
+Currently the KSK is SHARSA256 1024 bits and the ZSK is SHARSA256 2048 bits, I
+am considering moving to using a 2048 bit KSK but I'm not sure if there will be
+much of a benefit. I am using NSEC3 with a SHA-1 hash with the opt-out bit
+unset and 100 iterations.
+
+In any case, you can now rest assured that if your resolver uses DNSSEC
+(Google's resolvers will return a failure in case they find a DS record but the
+DNSSEC validation fails) you will be receiving signed and verifiable data. Of
+course, I doubt many people care.
+
+[cheatsheet]: https://kb.isc.org/getAttach/122/AA-01311/DNSSEC-QR-B4.pdf