DNSSEC Inspector

Overview

DNSSEC Inspector is a comprehensive tool designed to analyze and verify the DNSSEC (Domain Name System Security Extensions) configuration of any domain. It thoroughly examines the entire chain of trust, validates signatures, and provides a detailed report on the domain's DNSSEC health.

What is DNSSEC?

DNSSEC is a set of extensions to DNS that provide:

1. Origin authentication of DNS data
2. Data integrity
3. Authenticated denial of existence

DNSSEC protects against DNS spoofing attacks by digitally signing DNS records, allowing resolvers to verify their authenticity.

Key DNSSEC Components

• DNSKEY: Public keys used to sign and verify DNS records
• RRSIG: Digital signatures for DNS record sets
• DS: Delegation Signer; creates a chain of trust between zones
• NSEC/NSEC3: Authenticated denial of existence for DNS records

How DNSSEC Inspector Works

The tool performs the following checks:

1. Retrieves and verifies DNSKEY records for the root, TLD, and domain zones
2. Checks for the presence and validity of RRSIG records
3. Verifies the DS records in the parent zones
4. Validates the chain of trust from the root to the target domain

Understanding the Report

The DNSSEC Inspector report includes:

• Overall DNSSEC status (Secure, Insecure, or Bogus)
• Detailed breakdown for each zone in the chain of trust
• Specific information about DNSKEY, RRSIG, and DS records
• Validation results for each step in the DNSSEC chain

Common DNSSEC Issues

1. Missing or incorrect DS records in the parent zone
2. Expired RRSIG records
3. Mismatched key tags between DNSKEY and RRSIG records
4. Incomplete chain of trust

Best Practices for DNSSEC Deployment

1. Regularly rotate DNSSEC keys
2. Monitor RRSIG expiration dates
3. Ensure timely updates of DS records in the parent zone
4. Use strong algorithms for signing (e.g., RSASHA256, ECDSAP256SHA256)
5. Implement a secure key management process

Using DNSSEC Inspector

1. Enter the domain name you want to inspect
2. Click the "Inspect DNSSEC" button
3. Review the detailed report provided by the tool
4. Address any issues identified in the DNSSEC configuration

Additional Resources

• IANA DNSSEC Practice Statement
• ICANN DNSSEC – What Is It and Why Is It Important?
• RFC 4033 - DNS Security Introduction and Requirements

By using DNSSEC Inspector regularly, you can ensure the integrity and security of your domain's DNS infrastructure, protecting against various DNS-based attacks and maintaining user trust.