1. A longitudinal, End-to-End View of the DNSSEC Ecosystem
Taejoong Chung, Roland van Rijswijk-Deij, Balakrishnan Chandrasekaran,
David Choffnes, Dave Levin, Bruce M. Maggs, Alan Mislove,
Christo Wilson
Presenter: Ruiyan Ma
A longitudinal, End-to-End View of the DNSSEC Ecosystem

2. Introduction: DNS
DNS maps domain name to IP address from its records

3. Introduction: DNSSEC
DNSSEC (DNS security extensions) gives each zone a digit signature, also validate their next level zone.
DNSKEY record
KSK
ZSK
RRSIG record
DS record

4. Problems in DNSSEC
DNSSEC is complex
DNSSEC is a new mechanism
DNSSEC need secure every DNS level from root to leaf

5. Motivation of Research
Previous researches doesn’t study the whole ecosystem
Researchers want to know the percentage of DNSSEC deployment
Researchers want to know the trend of DNSSEC deployment
Researchers want to know the management level

6. Solutions Data Collection: Collect large number of data
Research Range: Investigate over .com, .net, .org zones, over 150M domains
Time cost: Take long period for data collection, about two years
Solutions

7. Result: DNSSEC Deployment
The percentage of DNSSEC enabled domains keeps at low level.
The number of DNSSEC enabled domains is increasing

8. Result: Management
Record management
Key management

9. Record Management DS record
28%-32% signed domains do not have DS record
RRSIG record
Most domains have the record, some domain start updating at late time
Missing Record
Almost the whole domain with the records are valid
Most RRSIG record are valid
Incorrect Record

10. Key Management Three problems are observed Shared keys Weak keys
Keys does not update frequently

11. Result: Resolver support
Lots resolvers do not make validation
Some of validations are not correct

12. Criticism Advantage Disadvantage Large number of data Long period
The research only use Alexa Top 1M domains, and Top 1K website to collect data, the sample may not standard for the whole ecosystem.

13. Summary
The research shows most of DNS do not enable DNSSEC, but the trend is slowly increasing.
Some DNSSEC enabled DNS does not fully satisfy the requirement of DNSSEC
Most resolvers do not validate DNS record
The ecosystem of DNSSEC need to keep improve.

14. Thank you