A longitudinal, End-to-End View of the DNSSEC Ecosystem Taejoong Chung, Roland van Rijswijk-Deij, Balakrishnan Chandrasekaran, David Choffnes, Dave Levin, Bruce M. Maggs, Alan Mislove, Christo Wilson Presenter: Ruiyan Ma A longitudinal, End-to-End View of the DNSSEC Ecosystem

Introduction: DNS DNS maps domain name to IP address from its records

Introduction: DNSSEC DNSSEC (DNS security extensions) gives each zone a digit signature, also validate their next level zone. DNSKEY record KSK ZSK RRSIG record DS record

Problems in DNSSEC DNSSEC is complex DNSSEC is a new mechanism DNSSEC need secure every DNS level from root to leaf

Motivation of Research Previous researches doesn’t study the whole ecosystem Researchers want to know the percentage of DNSSEC deployment Researchers want to know the trend of DNSSEC deployment Researchers want to know the management level

Solutions Data Collection: Collect large number of data Research Range: Investigate over .com, .net, .org zones, over 150M domains Time cost: Take long period for data collection, about two years Solutions

Result: DNSSEC Deployment The percentage of DNSSEC enabled domains keeps at low level. The number of DNSSEC enabled domains is increasing

Result: Management Record management Key management

Record Management DS record 28%-32% signed domains do not have DS record RRSIG record Most domains have the record, some domain start updating at late time Missing Record Almost the whole domain with the records are valid Most RRSIG record are valid Incorrect Record

Key Management Three problems are observed Shared keys Weak keys Keys does not update frequently

Result: Resolver support Lots resolvers do not make validation Some of validations are not correct

Criticism Advantage Disadvantage Large number of data Long period The research only use Alexa Top 1M domains, and Top 1K website to collect data, the sample may not standard for the whole ecosystem.

Summary The research shows most of DNS do not enable DNSSEC, but the trend is slowly increasing. Some DNSSEC enabled DNS does not fully satisfy the requirement of DNSSEC Most resolvers do not validate DNS record The ecosystem of DNSSEC need to keep improve.

Thank you