深入浅出DNS系列（十）- DNSSEC

10 DNSSEC

参考文档：
http://wenku.baidu.com/link?url=QXrVoZZTra3YU0kfq8tCcGgp9DTP5xoyoUPLT0DI2BVl28ZtMp8YyKSn8FsfosJq6GmPd5Kv3AewjY1km_EYFjbFfXBMJ_aNfD5_6nJFVGG http://www.litouch.com/blog/897.html http://users.isc.org/~jreed/dnssec-guide/dnssec-guide.html
rfc4033《DNS Security Introduction and Requirements》

rfc4034《Resource Records for the DNS Security Extensions》

rfc4035《Protocol Modifications for the DNS Security Extensions》

rfc5155《DNS Security (DNSSEC) Hashed Authenticated Denial of Existence》

rfc5011《Automated Updates of DNS Security (DNSSEC) Trust Anchors》

rfc3225 《Indicating Resolver Support of DNSSEC》

rfc3008 《Domain Name System Security (DNSSEC) Signing Authority》

10.1 如何判定一台DNS服务器是否支持DNSSEC？

10.1.1 检查一个有DNSSEC签名的域名的RRSIG(Resource Record Signature)

为了让结果看得更清楚，我们找一个配置了DNSSEC签名的域名(paypal.com)，一个支持DNSSEC的DNS服务器(8.8.8.8)，和一个不支持DNSSEC的DNS服务器(114.114.114.114)。

支持dnssec的查询如下：



不支持dnssec查询如下：

10.2 DNSSEC涉及的6种记录

参考文档：
http://users.isc.org/~jreed/dnssec-guide/dnssec-guide.html
RRSIG (digital signature)

DNSKEY (public key)

DS (parent-child)

NSEC (proof of nonexistence)

NSEC3 (proof of nonexistence)

NSEC3PARAM (proof of nonexistence)

10.3 DNSSEC的查询过程

参考文档：
http://users.isc.org/~jreed/dnssec-guide/dnssec-guide.html

10.4 配置bind支持dnssec实例

其使用实例，请参考《内部根服务器架设实例》中DNSSEC的相关章节

参考文档：
http://blog.csdn.net/zhu_tianwei/article/details/45082015 http://blog.csdn.net/zhu_tianwei/article/details/45075577 http://www.isc.org/downloads/bind/bind-keys/

10.4.1 编译选项

CFLAGS="-g -O0" ./configure --prefix=/usr/local/sbin/bind --with-openssl=yes --disable-openssl-version-check

10.5 问题一（gethostbyname如何支持DNSSEC）

gethostbyname如何支持dnssec，或者说libc库如何支持dnssec

dnssec描述的是递归解析器到其他域名服务器之间的安全方案，那么从主机到递归解析器之间的安全如何保证?

参考文档：
http://www.linuxidc.com/Linux/2016-02/128188.htm http://www.sourceware.org/glibc/wiki/DNSSEC

10.6 KSK与ZSK的区别

Key	Usage	Frequency of Use
ZSK Private	Used by authoritative server to create RRSIG for zone data	Used somewhat frequently depending on the zone, whenever authoritative zone data changes or re-signing is needed
ZSK Public	Used by recursive server to validate zone data RRset	Used very frequently, whenever recursive server validates a response
KSK Private	Used by authoritative server to create RRSIG for ZSK and KSK Public (DNSKEY)	Very infrequently, whenever ZSK's or KSK's change (every year or every five years in our examples)
KSK Public	Used by recursive server to validate DNSKEY RRset	Used very frequently, whenever recursive server validates a DNSKEY RRset