Dmitry Kokhmanyuk: DNSSEC will provide better protection for your domain.

DNS Protocol Extension –DNSSEC systemis being actively implemented in many domain zones. We previously wrote about the fact thatThe German domain has switched to DNSSEC support.,largest registrarsare also implementing this protocol. A few days ago,DNSSEC key generation ceremony for the .UA domain.

The administrator of the .UA domain kindly agreed to tell us more about the DNSSEC system.Dmitry Kokhmanyuk.

1. Why was it necessary to introduce the DNSSEC protocol? Why is DNSSEC considered a secure protocol?

DNSSEC is not a new protocol, but an extension (or rather, several extensions) to the old DNS protocol (domain name systems). These extensions are quite complex and cannot be described in a short text—a full description would take up nearly half a thousand pages. The main function of DNSSEC is to detect and protect against insecurity in the channel between the resolver and the authoritative DNS server, or, more simply, the network access provider and the domain owner.

This protection against counterfeiting is somewhat similar to certificates used to connect to websites via HTTPS - the user can ensure that the connection has not been intercepted and the site's content has not been tampered with. As with HTTPS, DNSSEC leaves users unprotected from security vulnerabilities in the server itself (hacking a DNS server hosting a DNSSEC-signed domain's zone file, similar to hacking a server hosting a secure website, will result in data tampering). DNSSEC also offers no protection if the key is disclosed (again, due to a hack of the server hosting the key). However, as with HTTPS, the DNSSEC-enabled domain owner has the option of revoking the old key and generating a new one (in which case, it will take some time for all clients to learn that the old key is no longer valid). Finally, there's the issue of trusting the certification authority—except that in DNSSEC, these authorities are assumed by domain name registrars and (partially) domain administrators, who store copies of DNSSEC public key fingerprints. The private portions of the keys are not stored by third parties.

2. What benefits do registrars and users receive in this case?

As I mentioned above, users will receive additional protection against the distortion or deletion of information about the location of their domain resources on the Internet. Simply put, domains will have a checksum that can be verified by the user. For DNSSEC validation to work fully, applications and operating systems must be updated. This is not yet widely available—for example, there is a Firefox plugin that displays DNSSEC validation on a domain when you view a website. This plugin is called DNSSEC Validator :: Add-ons for Firefox -https://addons.mozilla.org/en-US/firefox/addon/dnssec-validator/

3. What will change in how registrars operate? How will users externally notice the use of DNSSEC?

First, the domain registry must enable DNSSEC support (by signing the corresponding zone file). This process involves several steps. After that, support for so-called DS records (short for Delegation Signer) must be added to the registry's protocol for communicating with registrars. These records are similar to traditional NS (Name Server) records and transmit subdomain checksums.

After this, registrars can add this new feature to their client tools—the contract, domain control panel, and hosting product. The client must then use this feature themselves (either by signing the zone themselves or by contacting the registrar). Essentially, registrars now have a completely new service—DNSSEC hosting. Registrars can implement it in various ways. Users will see (via the new software) that the domain is now "secure."

4. Many domain zones already support DNSSEC. How is DNSSEC implementation progressing in Ukraine? Is the Ukrainian domain zone lagging behind in DNSSEC implementation?

Most country domains don't yet use DNSSEC. However, Europe's largest domains—.DE, .UK, .NL (Germany, England, the Netherlands)—are using the new extensions. The .UA domain will be signed—work is already underway at the lastUadom conferences was the master key has been created.

I can’t say yet about the exact time frame, but I, for my part, will try to do everything well and without haste.

I'd like to point out that in Russia, the .RU and .РФ domains have not yet been signed—only the former USSR domain .SU.

5. Should DNSSEC be a paid service for domain owners and registrars?

The answer to this question lies with the registrars. I'll just note that the introduction of DNSSEC will not increase the cost of registering domains without it. I hope security won't come at a high cost.

6. What challenges do you see in introducing DNSSEC in Ukraine?

First of all, there's low internet penetration in general (less than one-third of the population) and complex technologies in particular. For my part, I participate in Hostmaster-sponsored workshops on new technologies (IPv6 and DNSSEC). At the most recent one, there were two presentations on DNSSEC:"Workshop Meeting 4: Beyond IPv6".

In addition to the lack of knowledge among ISP and hosting company specialists about the benefits and operating principles of the new technology, there's also the problem of outdated operating system versions. I recommend using the latest developments from Apple and Microsoft (or Linux), as they support DNSSEC out of the box. Firefox and Chrome, which I've already mentioned, are DNSSEC-aware.

Finally, I appeal to users: demand new services! Just as the exhaustion of IPv4 (the old Internet addressing protocol) addresses necessitated the implementation of IPv6 (version 6), only persistent demands on providers and registrars to support DNSSEC will make it a reality.

Start by installing on your computer (personal) a unique development of NLnet Labs - the program dnssec-trigger (http://www.nlnetlabs.nl/projects/dnssec-trigger/); I use it myself. This small, constantly running server will not only reduce DNS query processing time thanks to its cache, but will also automatically alert you if, for any reason, secure DNS is not working.

Note: The author is not the developer of the program and is not responsible for its use.

7. Are there any vulnerabilities in DNSSEC? Can we call this standard a panacea for most exploited vulnerabilities and web attacks?

No software, even the highest quality, can be a panacea. Let's start with the human factor. Everyone is familiar with the message: "Attention! The website address information has not been verified. Continue?" And many agree to go to the site, thinking something like, "Come on, I have to get to work; these stupid questions are always a waste of time!" Something as complex as the Internet cannot be 100% secure. And despite the fact that the DNSSEC standard has been in development for fifteen years and has been implemented for at least five (in the DNS root zone, for two years now, from the start of work on December 1, 2009, to the publication of the master key hash on July 15, 2010), it is still an experiment, albeit a highly successful one.

8. How urgent is the introduction of DNSSEC, given the large number of different attacks and hacks? Will the number of attacks decrease after the introduction of DNSSEC?

The number of attacks is unlikely to decrease—like spam, it's one of those evils we have to live with and deal with. The effectiveness of some DNS attacks will be significantly reduced—provided that the user, provider, and domain owner all use DNSSEC. Of course, protection must be multi-layered—and in the technological pie, the DNS layer is far from the only one, but it is one of the most important.

Thank you for your questions. I'm confident that through collective efforts we can make our shared internet, including its Ukrainian counterpart, safer for all its users.

Note: This interview was verified via email. Dmitry does not speak on behalf of any other people or organizations. Factual errors, inaccuracies, or typos are possible.