DNS Paranoia

Using "dnssec.dnsp.co"

Three names under "dnssec.dnsp.co" let you find out whether your resolver actually validates DNSSEC, rather than merely passing the flag along.

DNSSEC signs DNS answers so that a resolver can detect one that has been tampered with. It only helps if the resolver checks the signature. A resolver that forwards signed data without verifying it gives you no protection at all, and there is no way to tell the difference from an ordinary lookup — which is what these three names are for.

ok.dnssec.dnsp.co is signed correctly.

bad.dnssec.dnsp.co is signed, then one bit of the signature is flipped.

expired.dnssec.dnsp.co is signed with a validity window that has already passed.

A validating resolver answers the first with the AD (authentic data) flag set, and refuses the other two with SERVFAIL. A resolver that does not validate returns all three quite happily — and that is the finding, because it would hand you a forged answer just as readily.

A correctly signed name, through a validating resolver:


prompt> dig +dnssec ok.dnssec.dnsp.co A
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2

;; ANSWER SECTION:
ok.dnssec.dnsp.co.	300	IN	A	198.51.100.42
ok.dnssec.dnsp.co.	300	IN	RRSIG	A 8 4 300 20260916015338 ...

The deliberately broken one:


prompt> dig +dnssec bad.dnssec.dnsp.co A
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 51442  ← your resolver validates

;; ANSWER SECTION:
(none)