dnssec

Bilingual

Using DNSSEC
2 months ago
- DNSSEC is a protocol that uses public-key cryptography to ensure DNS result accuracy and prevent attacks like cache poisoning and DNS hijacking.
- Most computers do not use DNSSEC by default, as ISP-provided DNS servers often lack support.
- Configuring DNSSEC is straightforward with resources like Google's walkthrough.
- The author discovered a DNSSEC tester via a StackOverflow post and includes additional resources in the appendix.
Speed Up!
2 months ago
- Site load time reduced from 4.3 seconds to 223 milliseconds (a 10x improvement).
- DNSSEC testers added previously were causing a 2-second delay (1 second each).
- Removing the DNSSEC testers improved speed and user perception.
- The author feels more comfortable without DNSSEC testers, as they seemed like analytics.
- Remaining slow elements are Google Fonts (Open Sans) and a second DNS tester.
- Site is mostly static pages with minified CSS and minimal JavaScript.
Another Entry in the "Stuff Im Glad Im Not Responsible for" Ledger
2 months ago
- On July 3, 2026, a broken DNSSEC key rollover by the Albanian operator AKEP caused validation failures for the .al TLD, making sites unreachable for validating resolvers like Cloudflare's 1.1.1.1.
- Cloudflare implemented a Negative Trust Anchor (NTA) to temporarily suspend DNSSEC validation and restore resolution, similar to a previous .de incident, but NTAs previously lacked transparency about bypassed validation.
- During the .al incident, 1.1.1.1 introduced a new Extended DNS Error (EDE) code (EDE 33) to signal when an NTA is applied, providing clients with visibility that DNSSEC validation was bypassed.
- The incident highlights that TLD-level DNSSEC failures can affect all domains under that TLD, and EDE 33 helps close the transparency gap by informing users when responses are not DNSSEC-validated.
- The EDE 33 code is part of an Internet-Draft submitted to the IETF DNSOP Working Group, with support from tools like kdig, aiming to standardize disclosure of NTAs in DNS responses.
Why DMARC's new "NP" tag can fail with DNSSEC
3 months ago
- DMARC's new np tag (non-existent subdomain policy) was introduced in RFC 9989 to apply policies to non-existent subdomains.
- RFC 9989 defines non-existent domains by NXDOMAIN response code, but RFC 9824 (Compact Denial of Existence in DNSSEC) uses NOERROR with NXNAME bit for DNSSEC, causing a clash.
- Many DNS providers (e.g., Cloudflare, AWS Route 53) use compact denial, so NXDOMAIN is often not returned, leading np tag failures in DMARC implementations.
- DMARC implementations typically check for NXDOMAIN strictly and don't support DNSSEC or NXNAME bit, so np tag may not work for DNSSEC-signed domains.
- IETF discussions haven't resolved the issue; solutions include DMARC software checking NXNAME or wider adoption of NXDOMAIN restoration via CO flag.
- Domain owners should assume np tag may not work reliably, especially with DNSSEC and major DNS providers using compact denial.

dnssec

Using DNSSEC

Speed Up!

Another Entry in the "Stuff Im Glad Im Not Responsible for" Ledger

Why DMARC's new "NP" tag can fail with DNSSEC