By Robert Westervelt | Sep 14, 2009

2 comments

Facebook

LinkedIn

Digg

DNSSEC isn't a cure-all for DNS security issues. It won't stop drive-by attacks, protect against denial-of-service attacks or any other kind of attacks that piggyback on top of the DNS and depend upon social engineering for success. But it does block cache poisoning attacks and DNS hijacking, a problem that represents a major threat to ecommerce on the Internet. DNSSEC deployments are moving forward. Early adopters are beginning to develop best practices and education materials for upgrading systems and properly configuring devices to handle DNSSEC requests. Federal agencies are required to adopt DNSSEC by the end of the year for .gov domains. .Org was the first domain that signed on to DNSSEC. .Edu signed on to DNSSEC this week with its 6,000 registrants. .Net and .com are expected to sign on by 2011. In this interview, Lance Wolak, director of product management at PIR, which manages the .org domain and Ram Mohan, executive vice president and chief technology officer of Afilias Ltd. share their experiences and the road ahead for DNSSEC deployments.

.Org is the first top-level domain to sign on to DNSSEC. When did the project begin and why was .org the first?
Lance Wolak: The zone signing occurred on June 2 and that was our first step in implementation. This is the start of a testing period for DNSSEC. .Gov had recently taken steps to deploy DNSSEC. While they are a global top-level domain (GTLD), they are a highly restricted GTLD and .org is the first open GTLD to move forward. With 10.5 million names, it is really a significant milestone for the industry for a GTLD of this magnitude to step forward with this.
Ram Mohan: All of .org name servers in 25-plus locations worldwide respond validly to DNSSEC requests coming from any conforming resolver and provide a fluid response back. In addition, .org has also launched a program adding other domain names under .org into the zone one at a time. We're making sure those work properly and we're starting to begin a program that ensures normal transactions in domain names do not get affected. We're making sure things like creating a domain name or transferring a domain name from one registrar to another go through in the same seamless manner as they do today.

2 comments

Facebook

LinkedIn

Digg