Internet security hits major milestone, as .com signs on

VeriSign announced today that it has deployed the DNS Security Extensions (DNSSEC) in the .com generic top-level domain, the largest domain on the Internet with more than 90 million registered names.

The publishing of the new root zone for .com with delegation signature records at about 11 a.m. Eastern Time was called a critical milestone in deployment of the security protocols that help secure the Internet infrastructure.

“With almost half of all the domains on the Internet, a lot of people have been waiting for this,” said Matt Larson, vice president of DNS research at VeriSign Labs. The signing will help create the critical mass needed to make DNSSEC validation practical and common on the Internet.

Related stories:

The .net domain joins the DNSSEC fold

DNSSEC now fully deployed on the Internet root

VeriSign, an Internet infrastructure services provider, operates the authoritative domain name registry for .com and .net and also operates two of the Internet’s 13 root servers, a.root-servers.net and j.root-servers.net.

The Domain Name System (DNS) maps Internet domain names, such as GCN.com, to numerical IP addresses and underlies nearly all Internet activities. DNSSEC enables the use of digital signatures that can be used to authenticate DNS data that is returned to query responses. That will help combat attacks, such as pharming, cache poisoning and DNS redirection, that are used to misdirect traffic to malicious sites for fraud and the distribution of malware.

VeriSign began deploying DNSSEC in the .com domain in February in what Larson called a carefully controlled, incremental rollout plan that had been used with other domains. Also in February, the .com registry system was upgraded to allow registrars of .com domain names to submit signature records. Signed versions of the records were sent to name servers, which were serving signed records but with the signing keys deliberately obscured so that the signatures could not be validated. That was done to avoid complications from having only some servers delivering responses that could be validated while others could not.

The signing keys were made available over several days last week, and publication of the new root zone took place today, completing the process.

To be fully effective, DNSSEC must be deployed throughout the Internet’s domains. Interest in deploying the security protocols was sparked two years ago by the discovery of a vulnerability that would enable easy exploitation of weaknesses in DNS, but momentum has picked up in the past year.

The .gov top-level domain was signed in 2009. Agencies were supposed to deploy DNSSEC in their domains by the end of that year, but a year after the deadline, the signing of agency domains was far from complete with only 421 out of 1,185 federal .gov domains successfully using DNSSEC.

The .edu zone was signed early in 2010, the .org zone was signed in March 2010, and .info was signed in September 2010. In December, VeriSign completed signing of the .net top-level domain, which has more than 13 million registered names. The signing of .com brings the number of generic top-level domains signed to 10. There are also at least 45 country-level domains signed, out of 248.

DNSSEC was fully deployed by operators of the Internet’s authoritative root zone in July 2010, providing a trust anchor that can now tie together islands of trust that have been created by the deployment of DNSSEC in isolated domains.

That becomes more important as the Internet continues to grow. VeriSign reported earlier this year that there were 205.3 million domain name registrations across all top-level domains at the end of last year, a 1.7 percent increase over the third quarter of 2010. Registrations grew by 12.1 million in 2010, or 6.3 percent over 2009 figures. VeriSign's average daily DNS query load in the fourth quarter of 2010 was 61 billion, with a peak of 72 billion.

The next step in fully enabling DNSSEC is for owners of domain names in the top-level domains to digitally sign their DNS records so they can be validated. “That means the [Internet service providers] and enterprises have to enable DNSSEC validation,” said Sean Leach, VeriSign’s vice president of technology.

To that end, VeriSign also announced enhancements to its Managed DNS cloud-based hosting solution to provide full support for DNSSEC and enable easy signing and key management.

Before .com joined in, .org was the largest TLD to deploy DNSSEC, with about 13 million domains when it was signed in December 2010. Within government, the .gov domain was among the first to deploy the extensions, although .mil has yet to.

Generic Top Level Domains with DNSSEC enabled:

.asia

.biz

.cat

.com

.edu

.gov

.info

.museum

.net

.org

Generic Top Level Domains without DNSSEC enabled:

 .aero

.coop

.int

.jobs

.mil

.mobi

.name

.pro

.tel

.travel

.xxx (just added)

 Of 248 country code Top Level Domains, 45 have DNSSEC at least partially enabled, including .us.

(Source: Internet Assigned Numbers Authority)