I hope the situation gets resolved swiftly, and lessons learned from this incident can contribute to stronger and more reliable DNSSEC practices in the future.
You're not learning if you're not failing, so failing is good actually.
DNSSEC KSK rollover breaks DNS resolution for .nz domains
11–20 of 181 posts
Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains
#12I hope the situation gets resolved swiftly, and lessons learned from this incident can contribute to stronger and more reliable DNSSEC practices in the future.
You're not learning if you're not failing, so failing is good actually.
I think the pithy saying is that we learn best from failure, not that there is no other way to learn.
Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains
#13Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains
#14Been there, done that, albeit on a smaller scale. And I don't envy the people running the .nz registry at all, and they have my best wishes.
Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains
#15DNSSEC designers screwed up by making rollovers to be atomic. Instead, they should have allowed the responses to be signed by two keys. And a way to specify as a hint which key should be used, so that the zone owner could gather feedback on the rollover safety.
Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains
#16Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains
#17Earlier quoted context omitted.
Fortunately, New Zealanders benefit from all of the problems solved by DNSSEC.
Isn't DNSSEC basically obsoleted by DoH?
In a sense, yes, but not so much so that DoH is a dispositive argument for deprecating it.
The difference is that DoH protects transactions and DNSSEC protects the authenticity of records. It's perfectly possible for a DoH server to feed you bogus cached records; you have to trust the DoH server you're talking to, where you wouldn't have to do that if all the records on the chain of lookups you're doing are signed with DNSSEC, and you're running DNSSEC on your local system rather than a stub resolver than talks to full resolver server you have to trust (this is an uncommon set of circumstances and in practice you have exactly the same server trust problem with DNSSEC that you do with DoH).
Muddying the waters further, the attacks DNSSEC protects against overlap with the ones DoH protects again, so that if the whole Internet managed to switch to DoH, you'd have bottom-up built 95% of the security feature DNSSEC is attempting to provide (DoH has massively better deployment stats than DNSSEC, so this is plausible).
It's better to think of DoH as one of a catalog of different arguments that together make a clear case for sticking a fork in DNSSEC and calling it done.
Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains
#18Earlier quoted context omitted.
Isn't DNSSEC basically obsoleted by DoH?
In a sense, yes, but not so much so that DoH is a dispositive argument for deprecating it. The difference is that DoH protects transactions and DNSSEC protects the authenticity of records. It's perfectly possible for a DoH server to feed you bogus cached records; you have to trust the DoH server you're talking to, where you wouldn't have to do that if all the records on the chain of lookups you're doing are signed wi…
> DoH has massively better deployment stats than DNSSEC, so this is plausible
Is this actually true where it matters? (i.e. the root servers and authoritative servers for TLDs)?
Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains
#19Earlier quoted context omitted.
Fortunately, New Zealanders benefit from all of the problems solved by DNSSEC.
Isn't DNSSEC basically obsoleted by DoH?
They serve different purposes. DoH protects DNS information while in flight. DNSSEC cryptographicly signs DNS records so they can be validated as being created by the owner of the domain. With only DoH you can be assured of privacy in flight and that the response hasn't been changed in flight; however, you don't know that the records on the server you connected to have not been manipulated.
Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains
#20Earlier quoted context omitted.
In a sense, yes, but not so much so that DoH is a dispositive argument for deprecating it. The difference is that DoH protects transactions and DNSSEC protects the authenticity of records. It's perfectly possible for a DoH server to feed you bogus cached records; you have to trust the DoH server you're talking to, where you wouldn't have to do that if all the records on the chain of lookups you're doing are signed wi…
> DoH has massively better deployment stats than DNSSEC, so this is plausible Is this actually true where it matters? (i.e. the root servers and authoritative servers for TLDs)?
Where what matters? On-path DNS attacks occur everywhere across the Internet, and are probably more common on the lookup side and at the edges. Certainly, the use of DoH to protect authority transactions isn't common, yet!