Services/DNS

Service 'DNS'

Description	Available services: full hosting (NS1) on our servers replication (NS2) on our servers or, at your choice, partner servers (currently via Hivane)
Prerequisite	You need to buy a domain from a registrar and ask an administrator to configure this service.
Account	Global (registration required)	IPv6 Ready	Yes
Security Notes	Your zone content can be secured using DNSSEC, and replication can be secured too using TSIG (see below).

Master Zones Administration

To have your master zone modified on our servers, you can:

• use our UserMagicalInterface
• ask administrators

DNS Security

To provide as much security as possible, DC supports the following mechanisms.

TSIG

This protocol allows a secure transfer of zones between primary and secondary servers.

The DC's DNS servers support TSIG and comminication between them are always secured. The following entities are known to support TSIG and can then securely transfer zones to/from DC:

• Hivane

DNSSEC

What is DNSSEC?

This protocol aims at establishing a chain of trust, from the root of the DNS, to ensure response to queries on a zone has not been altered on the way. With the root zone public key, it is possible to validate the replies step by step down to your zone, for example: root public key -> . zone -> NS for org. -> org. zone -> NS for milkypond.org. -> milkypond.org. zone -> irc.milkypond.org. entry. Unfortunately, many DNS providers do not support DNSSEC (Gandi is one of them :-/).

In order to help people work on securing their zone, and be ready when their provider is, the ISC created a solution to validate zones using another secure path: by publishing security associations in a special zone (dlv.isc.org, called the DLV Registry), which itself can be validated the normal way. This is only a stopgap, but as providers seems not to be in a hurry to do their job, DC decided to use it.

How to use it for my zones?

DC DNS servers are able to handle the complicated procedure needed to sign a zone for you. You can just modify it the classic way, and have it signed automatically. You just need to ask us to switch the zone to the secure mode. If your provider gladly support DNSSEC, we can provide the necessary information for the chain of trust; if not, we can use the DLV registry. Beware DNS always means propagation delays, so you may have to wait a few days before the switch is completed and your zone fully secured over the whole world.

How to test my zone is secured?

First, you need a validating DNS server (explanations for bind9 on Debian):

• get the root zone public key (using this script for example: File:Get dns root zone key.sh)
• add the key to your configuration (in /etc/bind/named.conf):

include "/etc/bind/root.keys";

• add in your global options (/etc/bind/named.conf.options):

dnssec-enable yes;
dnssec-validation yes;

• restart bind

The DLV Registry public key is already provided in the bind9 package.

Then, you can check it with the dig tool (available in the dnsutils Debian package):

dig +dnssec <zone>

Look at the flags: it is secured if you find the ad flag. If there is the aa flag instead, then you are interrogating on of the authoritative DNS servers for the zone, it is also secure, but better test it on another server to be sure it is propagated.

If you check an entry of your zone which is a CNAME, beware the CNAME is resolved and if the destination name cannot be validated, then your entry won't either.

Documentation

• generic documentation on DNS

Technical Details

This service is made using:

• Bind9