A measurement study of DNSSEC misconfigurations

van Adrichem, N.L.M.; Blenn, N.; Reyes Lua, A; Wang, X.; Wasif, M; Ficky Fatturrahman, Ficky; Kuipers, F.A.

A measurement study of DNSSEC misconfigurations

Journal article (2015)

Authors

N.L.M. van Adrichem Network Architectures and Services -

N. Blenn Network Architectures and Services -

A Reyes Lua External organisation

X. Wang Network Architectures and Services -

M Wasif External organisation

Ficky Ficky Fatturrahman External organisation

F.A. Kuipers Network Architectures and Services -

Research Group

Network Architectures and Services () (TU Delft)

DNS Authentication Signatures Validation Misconfiguration Integrity DNSSEC Domain Name System Error Unreachability

To reference this document use:

http://resolver.tudelft.nl/uuid:da4746c7-70bd-4fe9-9207-8fc4ddb1b843

More Info

expand_more

Published Date

19-10-2015

Language

English

Reuse Rights

Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.

Faculty

Electrical Engineering, Mathematics and Computer Science

Department

Quantum & Computer Engineering

Research Group

Network Architectures and Services

Abstract

DNSSEC offers protection against spoofing of DNS data by providing origin authentication, ensuring data integrity and authentication of non-existence by using public-key cryptography. Although the relevance of securing a technology as crucial to the Internet as DNS is obvious, the DNSSEC implementation increases the complexity of the deployed DNS infrastructure, which may result in misconfiguration. In this article, we measure and analyze the misconfigurations for domains in six zones (.bg, .br, .co, .com, .nl and .se). Furthermore, we categorize these misconfigurations and provide an explanation for their possible causes. Finally, we evaluate the effects of misconfigurations on the reachability of a zone’s network. Our results show that, although progress has been made in the implementation of DNSSEC, over 4 % of evaluated domains show misconfigurations. The domains with the most frequently appearing misconfiguration are often hosted at a very limited set of hosting providers. Of these misconfigured domains, almost 75 % were unreachable from a DNSSEC-aware resolver. This illustrates that although the authorities of a domain may think their DNS is secured, it is in fact not. Worse still, misconfigured domains are at risk of being unreachable from the clients who care about and implement DNSSEC verification, while the publisher may remain unaware of the error and its consequences.