DNSSEC now fully deployed on the Internet root

Operators of the Internet’s authoritative root zone last week completed deployment of enhanced security protocols at the top level of the Domain Name System.

The Internet’s 13 root zone DNS servers have been digitally signed using the DNS Security Extensions (DNSSEC) since May. On July 15 the signed root zone was made available and a trust anchor was published with cryptographic keys that will allow users to verify the authenticity of DNS address requests.

To be fully effective DNSSEC must be deployed throughout the Internet’s domains, but the publication of the trust anchor for the Internet root means it now is possible to begin linking together the “islands of trust” that have been created by the deployment of DNSSEC in isolated domains, such as .gov and .org.

Related stories:

Another domain adopts added DNS security

Can .gov trust .com?

“The deployment of DNSSEC at the root zone is the linchpin to facilitating its deployment throughout the world and enabling the current domain-name system to evolve into a significant new trust infrastructure for the Internet,” Patrick Gallagher, director of the National Institute of Standards and Technology, said in announcing the deployment.

The DNS root zone, which contains the records needed to resolve the domain names used by people to IP addresses used by routers and servers, is overseen by the Commerce Department’s National Telecommunications and Information Administration and the files are managed by VeriSign Inc. DNSSEC provides a layer of security in the Internet by using cryptographic digital signatures to authenticate responses to DNS queries. The effort by NTIA, VeriSign and the Internet Corp. for Assigned Names and Numbers to deploy DNSSEC in the root zone has been called the biggest structural improvement to the DNS in 20 years.

Digitally signed responses to DNS queries that can be cryptographically validated are more difficult to spoof or manipulate. This can help to combat attacks such as pharming, cache poisoning, and DNS redirection that are used to commit fraud and identity theft and to distribute malware.

Although the root servers had been signed, they had been operating as a Deliberately-Unavailable Root Zone to avoid complications from having only some servers delivering digitally signed responses before being rolled out in full production. Full availability with publication of the trust anchor with keys to verify digital signatures took place Thursday evening. The root zone trust anchor can be found at here.

No harmful effects have been reported from the switch-over to full production, but ICANN, Commerce and VeriSign decided to suspend processing routine changes in the root zone until Tuesday, in the interest of stability.

“Conservative operational best practices call for changing only one part of a system at a time,” they announced. “Because of the magnitude of the change to the root zone represented by deploying DNSSEC, it is prudent to not make any additional changes so that any potential negative effects that might occur resulting from the DNSSEC deployment can be clearly observed and mitigated.”

Both sides of a DNS exchange—the browser and the DNS server—must be using DNSSEC in order for it to work. Most DNS requests do not go all the way to the root zone servers for resolution, but are answered by servers lower in the DNS hierarchy which share information.

The root zone trust anchor is essential to making DNSSEC practical. An individual signature is validated by following a chain of signatures to a key that provides the top level, or anchor, of trust. For a complete chain of trust, each domain and sub domain must be signed and validated. This has not yet been done, but the root trust anchor will allow those that have been signed to validate each other’s signatures.

Some top level domains already have been signed. The .org top level domain was signed in 2009 and spent a year been testing DNSSEC with a select “friends and family” group of test domains. It completed deployment and went operational in June. It is the largest generic top level domain to be signed so far, with 7.5 million domains registered in the space. The .gov top level domain was signed in 2009 under a mandate from the Office of Management and Budget; and .US, one of more than 200 top level country codes, was signed in December. These domains have operated as islands of trust that can now be bridged at the root.

The two largest top level domains, .net and .com, are expected to be signed in the fourth quarter of this year and the first quarter of next year, respectively. The .edu top level domain has already been signed and has been acting as a testbed for DNSSEC deployment, but keys have not yet been published. Plans originally called for .edu to go live before now, but when plans were announced to finalize the root zone it was decided to delay publication of .edu keys until that was completed.