Understanding the Role of Registrars in DNSSEC Deployment Taejoong - - PowerPoint PPT Presentation

▶
understanding the role of registrars in dnssec deployment
SMART_READER_LITE
LIVE PREVIEW

Understanding the Role of Registrars in DNSSEC Deployment Taejoong - - PowerPoint PPT Presentation

Sep 13, 2023 343 likes •1.54k views

Understanding the Role of Registrars in DNSSEC Deployment Taejoong (tijay) Chung, Roland van Rijswijk-Deij, David Choffnes, Dave Levin, Bruce M. Maggs, Alan Mislove, Christo Wilson 1 DNSSEC 101 example.com's Authoritative DNS Resolver DNS

slide-1
SLIDE 1

1

Understanding the Role of Registrars in DNSSEC Deployment

Taejoong (tijay) Chung, Roland van Rijswijk-Deij, David Choffnes, Dave Levin, Bruce M. Maggs, Alan Mislove, Christo Wilson

slide-2
SLIDE 2

DNSSEC 101

DNS Resolver example.com's Authoritative DNS Server

slide-3
SLIDE 3

DNSSEC 101

DNS Resolver example.com's Authoritative DNS Server

slide-4
SLIDE 4

DNSSEC 101

DNS Resolver A records w/ DO bit example.com's Authoritative DNS Server

slide-5
SLIDE 5

DNSSEC 101

DNS Resolver A records A records w/ DO bit example.com's Authoritative DNS Server

RRSIG

slide-6
SLIDE 6

DNSSEC 101

DNS Resolver A records A records w/ DO bit example.com's Authoritative DNS Server

RRSIG

Previous work

DNSSEC deployment is very rare (~1%) but 30% of them tried (but failed to deploy correctly)

slide-7
SLIDE 7

DNSSEC 101

DNS Resolver A records A records w/ DO bit example.com's Authoritative DNS Server

RRSIG

Previous work

DNSSEC deployment is very rare (~1%) but 30% of them tried (but failed to deploy correctly)

Why?

slide-8
SLIDE 8

DNS Resolver

DNSSEC 101

3

example.com's Authoritative DNS Server

slide-9
SLIDE 9

DNS Resolver

DNSSEC 101

3

example.com's Authoritative DNS Server

slide-10
SLIDE 10

DNS Resolver

DNSSEC 101

3

A records w/ DO bit example.com's Authoritative DNS Server

slide-11
SLIDE 11

DNS Resolver

DNSSEC 101

3

A records A records w/ DO bit example.com's Authoritative DNS Server

RRSIG

slide-12
SLIDE 12

DNS Resolver

DNSSEC 101

3

A records A records w/ DO bit DNSKEY example.com's Authoritative DNS Server

RRSIG

slide-13
SLIDE 13

DNS Resolver

DNSSEC 101

3

A records A records w/ DO bit DNSKEY example.com's Authoritative DNS Server . (root zone) .com

RRSIG

slide-14
SLIDE 14

DNS Resolver DNSKEY

DNSSEC 101

3

A records A records w/ DO bit DNSKEY example.com's Authoritative DNS Server . (root zone) .com

RRSIG

slide-15
SLIDE 15

DNS Resolver DNSKEY

DNSSEC 101

3

A records A records w/ DO bit DNSKEY example.com's Authoritative DNS Server . (root zone) .com

RRSIG

slide-16
SLIDE 16

DNS Resolver DNSKEY

DNSSEC 101

3

A records A records w/ DO bit DNSKEY DNSKEY example.com's Authoritative DNS Server . (root zone) .com

RRSIG

slide-17
SLIDE 17

DNS Resolver DNSKEY

DNSSEC 101

3

A records A records w/ DO bit DNSKEY DNSKEY example.com's Authoritative DNS Server . (root zone) .com

RRSIG

slide-18
SLIDE 18

DNS Resolver DNSKEY

DNSSEC 101

3

A records A records w/ DO bit DNSKEY DNSKEY Chain-of-Trust example.com's Authoritative DNS Server . (root zone) .com

RRSIG

slide-19
SLIDE 19

DNSSEC 101 Hierarchical Structure

4

DNSKEY Chain-of-Trust DNSKEY DNSKEY

slide-20
SLIDE 20

DNSSEC 101 Hierarchical Structure

4

DNSKEY Chain-of-Trust DNSKEY DNSKEY

slide-21
SLIDE 21

DNSSEC 101 Hierarchical Structure

4

DNSKEY Chain-of-Trust DNSKEY DNSKEY

slide-22
SLIDE 22

DNSSEC 101 Hierarchical Structure

4

DNSKEY Chain-of-Trust DNSKEY

slide-23
SLIDE 23

DNSSEC 101 Hierarchical Structure

5

DNSKEY DNSKEY Chain-of-Trust

slide-24
SLIDE 24

DNSSEC 101 Hierarchical Structure

5

DNSKEY DNSKEY Chain-of-Trust .com example.com's Authoritative DNS Server

slide-25
SLIDE 25

DNSSEC 101 Hierarchical Structure

5

DNSKEY DNSKEY DNSKEY Chain-of-Trust .com example.com's Authoritative DNS Server

slide-26
SLIDE 26

DNSSEC 101 Hierarchical Structure

5

DNSKEY DNSKEY DNSKEY Chain-of-Trust


 =Hash( )

DNSKEY

DS Record .com example.com's Authoritative DNS Server

slide-27
SLIDE 27

DNSSEC 101 Hierarchical Structure

5

DNSKEY DNSKEY DNSKEY Chain-of-Trust


 =Hash( )

DNSKEY

DS Record .com example.com's Authoritative DNS Server

slide-28
SLIDE 28

DNSSEC 101 Hierarchical Structure

5

RRSIG

DS Record DNSKEY DNSKEY DNSKEY Chain-of-Trust


 =Hash( )

DNSKEY

DS Record .com example.com's Authoritative DNS Server

slide-29
SLIDE 29

DNSSEC 101 Hierarchical Structure

5

RRSIG

DS Record DNSKEY DNSKEY DNSKEY Chain-of-Trust

~ 30% of domains w/ DNSKEY DO NOT DO THIS!


 =Hash( )

DNSKEY

DS Record .com example.com's Authoritative DNS Server

slide-30
SLIDE 30

Registry, Registrar, and DNS Operator

6

.COM (Verisign) Registry (TLD) GoDaddy Registrar

slide-31
SLIDE 31

Registry, Registrar, and DNS Operator

6

.COM (Verisign) Registry (TLD) GoDaddy Registrar Buy example.com

slide-32
SLIDE 32

Registry, Registrar, and DNS Operator

6

.COM (Verisign) Registry (TLD) GoDaddy Registrar Buy example.com

slide-33
SLIDE 33

Registry, Registrar, and DNS Operator

6

.COM (Verisign) Registry (TLD) GoDaddy Registrar Buy example.com

DS Record

slide-34
SLIDE 34

Registry, Registrar, and DNS Operator

6

.COM (Verisign) Registry (TLD) GoDaddy Registrar Buy example.com

slide-35
SLIDE 35

Registry, Registrar, and DNS Operator

6

.COM (Verisign) Registry (TLD) GoDaddy Registrar Buy example.com

slide-36
SLIDE 36

Registry, Registrar, and DNS Operator

6

.COM (Verisign) Registry (TLD) GoDaddy Registrar Owner Buy example.com

slide-37
SLIDE 37

Registry, Registrar, and DNS Operator

6

.COM (Verisign) Registry (TLD) GoDaddy Registrar Owner Buy example.com

DS Record

slide-38
SLIDE 38

Registry, Registrar, and DNS Operator

6

.COM (Verisign) Registry (TLD) GoDaddy Registrar Owner Buy example.com

DS Record

slide-39
SLIDE 39

Registry, Registrar, and DNS Operator

6

.COM (Verisign) Registry (TLD) GoDaddy Registrar Owner Buy example.com

slide-40
SLIDE 40

Registry, Registrar, and DNS Operator

7

.COM (Verisign) GoDaddy Registry (TLD) Registrar Buy example.com

slide-41
SLIDE 41

Registry, Registrar, and DNS Operator

7

Delegate CloudFlare Third-Party DNS Operator .COM (Verisign) GoDaddy Registry (TLD) Registrar Buy example.com

slide-42
SLIDE 42

Registry, Registrar, and DNS Operator

7

Delegate CloudFlare Third-Party DNS Operator .COM (Verisign) GoDaddy Registry (TLD) Registrar Buy example.com

DS Record

slide-43
SLIDE 43

Registry, Registrar, and DNS Operator

7

Delegate CloudFlare Third-Party DNS Operator .COM (Verisign) GoDaddy Registry (TLD) Registrar Buy example.com

DS Record

slide-44
SLIDE 44

Registry, Registrar, and DNS Operator

7

Delegate CloudFlare Third-Party DNS Operator .COM (Verisign) GoDaddy Registry (TLD) Registrar Buy example.com

DS Record

slide-45
SLIDE 45

Registry, Registrar, and DNS Operator

7

Delegate CloudFlare Third-Party DNS Operator .COM (Verisign) GoDaddy Registry (TLD) Registrar Buy example.com

slide-46
SLIDE 46

Registry, Registrar, and DNS Operator

8

Delegate CloudFlare Third-Party DNS Operator .COM (Verisign) GoDaddy Registry (TLD) Registrar Buy example.com

slide-47
SLIDE 47

Registry, Registrar, and DNS Operator

8

Delegate CloudFlare Third-Party DNS Operator .COM (Verisign) GoDaddy Registry (TLD) Registrar

slide-48
SLIDE 48

Registry, Registrar, Reseller, and DNS Operator

9

Delegate CloudFlare Third-Party DNS Operator .COM (Verisign) ASCIO Registry (TLD) Registrar Buy example.com Antagonist Reseller

slide-49
SLIDE 49

Registry, Registrar, Reseller, and DNS Operator

9

Delegate CloudFlare Third-Party DNS Operator .COM (Verisign) ASCIO Registry (TLD) Registrar Buy example.com Antagonist Reseller

DS Record

slide-50
SLIDE 50

Registry, Registrar, Reseller, and DNS Operator

9

Delegate CloudFlare Third-Party DNS Operator .COM (Verisign) ASCIO Registry (TLD) Registrar Buy example.com Antagonist Reseller

DS Record

slide-51
SLIDE 51

Registry, Registrar, Reseller, and DNS Operator

9

Delegate CloudFlare Third-Party DNS Operator .COM (Verisign) ASCIO Registry (TLD) Registrar Buy example.com Antagonist Reseller

DS Record

slide-52
SLIDE 52

Registry, Registrar, Reseller, and DNS Operator

9

Delegate CloudFlare Third-Party DNS Operator .COM (Verisign) ASCIO Registry (TLD) Registrar Buy example.com Antagonist Reseller

DS Record

slide-53
SLIDE 53

Registry, Registrar, Reseller, and DNS Operator

9

Delegate CloudFlare Third-Party DNS Operator .COM (Verisign) ASCIO Registry (TLD) Registrar Buy example.com Antagonist Reseller

slide-54
SLIDE 54

Anecdotal Examples

10

Experiment Result

slide-55
SLIDE 55

Anecdotal Examples

10

We saw the DNSKEY deployed (but not DS records) so asked why you don’t upload DS records. Experiment Result

slide-56
SLIDE 56

Anecdotal Examples

10

We saw the DNSKEY deployed (but not DS records) so asked why you don’t upload DS records. [1] They removed a DNSSEC menu Experiment Result

slide-57
SLIDE 57

Anecdotal Examples

10

We saw the DNSKEY deployed (but not DS records) so asked why you don’t upload DS records. [1] They removed a DNSSEC menu Experiment Result [2] “Most people do not understand DNS, so imagine the white faces when I mention DNSSEC”

slide-58
SLIDE 58

Anecdotal Examples

10

We saw the DNSKEY deployed (but not DS records) so asked why you don’t upload DS records. [1] They removed a DNSSEC menu We asked a registrar to upload a DS record by email from the different email address than the one that registered Experiment Result [2] “Most people do not understand DNS, so imagine the white faces when I mention DNSSEC”

slide-59
SLIDE 59

Anecdotal Examples

10

We saw the DNSKEY deployed (but not DS records) so asked why you don’t upload DS records. [1] They removed a DNSSEC menu We asked a registrar to upload a DS record by email from the different email address than the one that registered It was installed successfully Experiment Result [2] “Most people do not understand DNS, so imagine the white faces when I mention DNSSEC”

slide-60
SLIDE 60

Anecdotal Examples

10

We saw the DNSKEY deployed (but not DS records) so asked why you don’t upload DS records. [1] They removed a DNSSEC menu We asked a registrar to upload a DS record to our domain via web live chat We asked a registrar to upload a DS record by email from the different email address than the one that registered It was installed successfully Experiment Result [2] “Most people do not understand DNS, so imagine the white faces when I mention DNSSEC”

slide-61
SLIDE 61

Anecdotal Examples

10

We saw the DNSKEY deployed (but not DS records) so asked why you don’t upload DS records. [1] They removed a DNSSEC menu We asked a registrar to upload a DS record to our domain via web live chat It was installed on someone else’s domain due to a mistake by the customer service agent We asked a registrar to upload a DS record by email from the different email address than the one that registered It was installed successfully Experiment Result [2] “Most people do not understand DNS, so imagine the white faces when I mention DNSSEC”

slide-62
SLIDE 62

Details of the Last Example

11

slide-63
SLIDE 63

Details of the Last Example

11

3:45:32 PM tijay hg-dnssec.com 3600 IN DS 2371 13 2 129f34c04ac58ece5218b9894148304a736a63757f58ff0cddd9b8df4989

slide-64
SLIDE 64

Details of the Last Example

11

3:45:32 PM tijay hg-dnssec.com 3600 IN DS 2371 13 2 129f34c04ac58ece5218b9894148304a736a63757f58ff0cddd9b8df4989 3:56:05 PM Jeniffer S Awesome! one moment

slide-65
SLIDE 65

Details of the Last Example

11

3:45:32 PM tijay hg-dnssec.com 3600 IN DS 2371 13 2 129f34c04ac58ece5218b9894148304a736a63757f58ff0cddd9b8df4989 3:56:09 PM Jeniffer S I have now save the request information! Manage DNSSEC paananenmusic.com Record added

  • successfully. It can take 4-8 hours for DNS to propagate

3:56:05 PM Jeniffer S Awesome! one moment

slide-66
SLIDE 66

Details of the Last Example

11

3:45:32 PM tijay hg-dnssec.com 3600 IN DS 2371 13 2 129f34c04ac58ece5218b9894148304a736a63757f58ff0cddd9b8df4989 3:56:09 PM Jeniffer S I have now save the request information! Manage DNSSEC paananenmusic.com Record added

  • successfully. It can take 4-8 hours for DNS to propagate

3:57:19 PM tijay paananenmusic.com? 3:57:28 PM tijay my domain is hg-dnssec.com? 3:56:05 PM Jeniffer S Awesome! one moment

slide-67
SLIDE 67

Details of the Last Example

11

3:45:32 PM tijay hg-dnssec.com 3600 IN DS 2371 13 2 129f34c04ac58ece5218b9894148304a736a63757f58ff0cddd9b8df4989 3:56:09 PM Jeniffer S I have now save the request information! Manage DNSSEC paananenmusic.com Record added

  • successfully. It can take 4-8 hours for DNS to propagate

3:57:19 PM tijay paananenmusic.com? 3:57:28 PM tijay my domain is hg-dnssec.com? 3:58:41 PM Jeniffer S I apologize, you are right, silly me,

  • ne moment

3:56:05 PM Jeniffer S Awesome! one moment

slide-68
SLIDE 68

Open Question

slide-69
SLIDE 69

Open Question

Why is so hard to deploy DNSSEC?

slide-70
SLIDE 70

Open Question

Why is so hard to deploy DNSSEC? How does registrar policy impact the deployment?

? ?

slide-71
SLIDE 71

Outline

Why is so hard to deploy DNSSEC?

slide-72
SLIDE 72

Outline

Why is so hard to deploy DNSSEC?

Popular registrar with lots of (1) domains and (2) DNSSEC-enabled domains

slide-73
SLIDE 73

Checking Registrar’s DNSSEC Policy

14

Registrar DNS Operator Registrar Supports DNSSEC?

slide-74
SLIDE 74

Checking Registrar’s DNSSEC Policy

14

Registrar DNS Operator Registrar Supports DNSSEC? Owner DNS Operator Registrar Supports DS upload?

slide-75
SLIDE 75

Checking Registrar’s DNSSEC Policy

14

Registrar DNS Operator Registrar Supports DNSSEC? Owner DNS Operator Registrar Supports DS upload? Registrar Validates DS record?

slide-76
SLIDE 76

Popular Registrar’s DNSSEC Policy

15

Registrar Supports DNSSEC? Registrar Supports DS upload? Registrar Validates DS record?

slide-77
SLIDE 77

Popular Registrar’s DNSSEC Policy

15

Registrar

GoDaddy (domaincontrol.com) NameCheap (registrar-servers.com) OVH (ovh.net) HostGator (hostgator.com) Amazon (aws-dns) Google (googledomains.com) 123-reg (123-reg.co.uk) RightSide (name.com) eNom (name-services.com) NameBright (namebrightdns.com) DreamHost (dreamhost.com) The others (10 registrars)

Registrar Supports DNSSEC? Registrar Supports DS upload? Registrar Validates DS record?

slide-78
SLIDE 78

Popular Registrar’s DNSSEC Policy

15

Registrar

GoDaddy (domaincontrol.com) NameCheap (registrar-servers.com) OVH (ovh.net) HostGator (hostgator.com) Amazon (aws-dns) Google (googledomains.com) 123-reg (123-reg.co.uk) RightSide (name.com) eNom (name-services.com) NameBright (namebrightdns.com) DreamHost (dreamhost.com) The others (10 registrars)

Registrar Supports DNSSEC? Registrar Supports DS upload? Registrar Validates DS record?

slide-79
SLIDE 79

Popular Registrar’s DNSSEC Policy

15

Registrar

GoDaddy (domaincontrol.com) NameCheap (registrar-servers.com) OVH (ovh.net) HostGator (hostgator.com) Amazon (aws-dns) Google (googledomains.com) 123-reg (123-reg.co.uk) RightSide (name.com) eNom (name-services.com) NameBright (namebrightdns.com) DreamHost (dreamhost.com) The others (10 registrars)

Registrar DNS Operator

Some nameservers don’t support DNSSEC Registrar Supports DNSSEC? Registrar Supports DS upload? Registrar Validates DS record? 2.5/20

slide-80
SLIDE 80

Popular Registrar’s DNSSEC Policy

16

Owner DNS Operator DS Upload Web Email

— — — — — — — —

Registrar

GoDaddy (domaincontrol.com) NameCheap (registrar-servers.com) OVH (ovh.net) HostGator (hostgator.com) Amazon (aws-dns) Google (googledomains.com) 123-reg (123-reg.co.uk) RightSide (name.com) eNom (name-services.com) NameBright (namebrightdns.com) DreamHost (dreamhost.com) The others (10 registrars)

Registrar Supports DNSSEC? Registrar Supports DS upload? Registrar Validates DS record? 2.5/20 11/20

slide-81
SLIDE 81

Popular Registrar’s DNSSEC Policy

17

DS Validation Registrar

GoDaddy (domaincontrol.com) NameCheap (registrar-servers.com) OVH (ovh.net) HostGator (hostgator.com) Amazon (aws-dns) Google (googledomains.com) 123-reg (123-reg.co.uk) RightSide (name.com) eNom (name-services.com) NameBright (namebrightdns.com) DreamHost (dreamhost.com) The others (10 registrars) Owner DNS Operator DS Upload Web Email

— — — — — — — —

Registrar Supports DNSSEC? Registrar Supports DS upload? Registrar Validates DS record? 2/20 2.5/20 11/20

slide-82
SLIDE 82

Popular Registrar

18

DNS Operator # of Registrar Support DNSSEC? Registrar 2.5/20 Owner 11/20 Check DS Validation Owner 2/11

Registrar DNSSEC Support for popular registrars is quite poor

Each registrar has different policy for supporting DNSSEC.

slide-83
SLIDE 83

Popular DNSSEC Support Registrars

19

Registrar Supports DNSSEC? Registrar Supports DS upload? Registrar Validates DS record?

Registrar

OVH (ovh.net) Loopia (loopia.se) DomainNameShop (hyp.net) TransIP (transip.net) MeshDigital (domainmonster.com) OVH (anycast.me) TransIP (transip.nl) Binero (binero.se) KPN (is.nl) PCExtreme (pcextreme.nl) Antagonist (webhostingserver.nl) NameCheap (registrar-servers.com)

slide-84
SLIDE 84

Registrar DNS Operator

20

Registrar DNS Operator

DNSSEC Default Publish DS Records?

Registrar

OVH (ovh.net) Loopia (loopia.se) DomainNameShop (hyp.net) TransIP (transip.net) MeshDigital (domainmonster.com) OVH (anycast.me) TransIP (transip.nl) Binero (binero.se) KPN (is.nl) PCExtreme (pcextreme.nl) Antagonist (webhostingserver.nl) NameCheap (registrar-servers.com)

Registrar Supports DNSSEC? Registrar Supports DS upload? Registrar Validates DS record? 10/12 Selective support

slide-85
SLIDE 85

Owner DNS Operator

Registrar Supports DNSSEC? Registrar Supports DS upload? Registrar Validates DS record? 10/12

Registrar

OVH (ovh.net) Loopia (loopia.se) DomainNameShop (hyp.net) TransIP (transip.net) MeshDigital (domainmonster.com) OVH (anycast.me) TransIP (transip.nl) Binero (binero.se) KPN (is.nl) PCExtreme (pcextreme.nl) Antagonist (webhostingserver.nl) NameCheap (registrar-servers.com)

slide-86
SLIDE 86

Owner DNS Operator

Registrar Supports DNSSEC? Registrar Supports DS upload? Registrar Validates DS record? 10/12

Owner DNS Operator

DS Upload

10/12

Registrar

OVH (ovh.net) Loopia (loopia.se) DomainNameShop (hyp.net) TransIP (transip.net) MeshDigital (domainmonster.com) OVH (anycast.me) TransIP (transip.nl) Binero (binero.se) KPN (is.nl) PCExtreme (pcextreme.nl) Antagonist (webhostingserver.nl) NameCheap (registrar-servers.com)

slide-87
SLIDE 87

DS Validation

22

DS Validation

Registrar Supports DNSSEC? Registrar Supports DS upload? Registrar Validates DS record? 10/12 10/12 2/12

— — Registrar

OVH (ovh.net) Loopia (loopia.se) DomainNameShop (hyp.net) TransIP (transip.net) MeshDigital (domainmonster.com) OVH (anycast.me) TransIP (transip.nl) Binero (binero.se) KPN (is.nl) PCExtreme (pcextreme.nl) Antagonist (webhostingserver.nl) NameCheap (registrar-servers.com)

Fetches a DNSKEY from the nameserver

Owner DNS Operator

DS Upload

slide-88
SLIDE 88

Other Security Issues

23

Registrar Supports DNSSEC? Registrar Supports DS upload? Registrar Validates DS record? 10/12 10/12 2/12

Registrar

OVH (ovh.net) Loopia (loopia.se) DomainNameShop (hyp.net) TransIP (transip.net) MeshDigital (domainmonster.com) OVH (anycast.me) TransIP (transip.nl) Binero (binero.se) KPN (is.nl) PCExtreme (pcextreme.nl) Antagonist (webhostingserver.nl) NameCheap (registrar-servers.com) DS Validation

Owner DNS Operator

DS Upload DS Upload Web Email

— — — — — — — —

slide-89
SLIDE 89

Other Security Issues

23

Registrar Supports DNSSEC? Registrar Supports DS upload? Registrar Validates DS record? 10/12 10/12 2/12

Registrar

OVH (ovh.net) Loopia (loopia.se) DomainNameShop (hyp.net) TransIP (transip.net) MeshDigital (domainmonster.com) OVH (anycast.me) TransIP (transip.nl) Binero (binero.se) KPN (is.nl) PCExtreme (pcextreme.nl) Antagonist (webhostingserver.nl) NameCheap (registrar-servers.com) DS Validation

Owner DNS Operator

DS Upload DS Upload Web Email

— — — — — — — —

slide-90
SLIDE 90

Outline

Why is DNSSEC deployment so rare? How does a registrar policy impact the deployment?

? ?

slide-91
SLIDE 91

Outline

Why is DNSSEC deployment so rare? How does a registrar policy impact the deployment?

? ? We need historical dataset

slide-92
SLIDE 92

Dataset

25

TLD Measurement Period (Daily Scan) Domains Total

Percent w/ DNSKEY

.com 2015/03/01 ~ 2016/12/31 118,147,199 0.7% .net 2015/03/01 ~ 2016/12/31 13,773,903 1.0% .org 2015/03/01 ~ 2016/12/31 9,682,750 1.1% .nl 2016/02/09 ~ 2016/12/31 5,674,208 51.6% .se 2016-06-07 ~ 2016/12/31 1,388,372 46.7%

slide-93
SLIDE 93

Dataset

25

TLD Measurement Period (Daily Scan) Domains Total

Percent w/ DNSKEY

.com 2015/03/01 ~ 2016/12/31 118,147,199 0.7% .net 2015/03/01 ~ 2016/12/31 13,773,903 1.0% .org 2015/03/01 ~ 2016/12/31 9,682,750 1.1% .nl 2016/02/09 ~ 2016/12/31 5,674,208 51.6% .se 2016-06-07 ~ 2016/12/31 1,388,372 46.7%

Over 750 billion DNS Records

slide-94
SLIDE 94

20 40 60 80 100 05/15 08/15 11/15 02/16 05/16 08/16 11/16 Loopia (*.loopia.se) Percent of domains with DNSKEY and DS record Date .com .net .org .se .nl 20 40 60 80 100 KPN (*.is.nl) .com .net .org .se .nl

[1] Registry: Financial Incentive

26

KPN

.nl measurement begins here .se measurement begins here

Loopia

slide-95
SLIDE 95

20 40 60 80 100 05/15 08/15 11/15 02/16 05/16 08/16 11/16 Loopia (*.loopia.se) Percent of domains with DNSKEY and DS record Date .com .net .org .se .nl 20 40 60 80 100 KPN (*.is.nl) .com .net .org .se .nl

[1] Registry: Financial Incentive

26

KPN

.nl measurement begins here .se measurement begins here

Loopia

slide-96
SLIDE 96

20 40 60 80 100 05/15 08/15 11/15 02/16 05/16 08/16 11/16 Loopia (*.loopia.se) Percent of domains with DNSKEY and DS record Date .com .net .org .se .nl 20 40 60 80 100 KPN (*.is.nl) .com .net .org .se .nl

[1] Registry: Financial Incentive

26

KPN

.nl measurement begins here .se measurement begins here

Loopia

slide-97
SLIDE 97

20 40 60 80 100 05/15 08/15 11/15 02/16 05/16 08/16 11/16 Loopia (*.loopia.se) Percent of domains with DNSKEY and DS record Date .com .net .org .se .nl 20 40 60 80 100 KPN (*.is.nl) .com .net .org .se .nl

[1] Registry: Financial Incentive

26

KPN

.nl measurement begins here .se measurement begins here

Loopia

slide-98
SLIDE 98

20 40 60 80 100 05/15 08/15 11/15 02/16 05/16 08/16 11/16 Loopia (*.loopia.se) Percent of domains with DNSKEY and DS record Date .com .net .org .se .nl 20 40 60 80 100 KPN (*.is.nl) .com .net .org .se .nl

[1] Registry: Financial Incentive

26

KPN

.nl measurement begins here .se measurement begins here

Loopia

slide-99
SLIDE 99

20 40 60 80 100 05/15 08/15 11/15 02/16 05/16 08/16 11/16 Loopia (*.loopia.se) Percent of domains with DNSKEY and DS record Date .com .net .org .se .nl 20 40 60 80 100 KPN (*.is.nl) .com .net .org .se .nl

[1] Registry: Financial Incentive

26

KPN

Financial Incentive

Financial gain is a huge incentive 
 for deploying DNSSEC

.nl measurement begins here .se measurement begins here

Loopia

slide-100
SLIDE 100

[2] Registrar: Free vs. Paid

27

5 10 15 20 25 30 05/15 08/15 11/15 02/16 05/16 08/16 11/16 Percent of domains with DS record Date OVH GoDaddy

slide-101
SLIDE 101

[2] Registrar: Free vs. Paid

27

5 10 15 20 25 30 05/15 08/15 11/15 02/16 05/16 08/16 11/16 Percent of domains with DS record Date OVH GoDaddy

slide-102
SLIDE 102

[2] Registrar: Free vs. Paid

27

5 10 15 20 25 30 05/15 08/15 11/15 02/16 05/16 08/16 11/16 Percent of domains with DS record Date OVH GoDaddy

slide-103
SLIDE 103

[2] Registrar: Free vs. Paid

27

5 10 15 20 25 30 05/15 08/15 11/15 02/16 05/16 08/16 11/16 Percent of domains with DS record Date OVH GoDaddy

Free vs. Paid

Free DNSSEC support encourages 
 users to deploy DNSSEC

slide-104
SLIDE 104

28

20 40 60 80 100 05/15 08/15 11/15 02/16 05/16 08/16 11/16 Percent of domains with DS and DNSKEY record Date .com .net .org .nl 10000 20000 30000 40000 50000 60000 70000 # of domains .com .net .org .nl

[3] Reseller (.com, .org, .net)

  • vs. Registrar (.nl)
slide-105
SLIDE 105

28

20 40 60 80 100 05/15 08/15 11/15 02/16 05/16 08/16 11/16 Percent of domains with DS and DNSKEY record Date .com .net .org .nl 10000 20000 30000 40000 50000 60000 70000 # of domains .com .net .org .nl

[3] Reseller (.com, .org, .net)

  • vs. Registrar (.nl)
slide-106
SLIDE 106

28

20 40 60 80 100 05/15 08/15 11/15 02/16 05/16 08/16 11/16 Percent of domains with DS and DNSKEY record Date .com .net .org .nl 10000 20000 30000 40000 50000 60000 70000 # of domains .com .net .org .nl

[3] Reseller (.com, .org, .net)

  • vs. Registrar (.nl)
slide-107
SLIDE 107

28

20 40 60 80 100 05/15 08/15 11/15 02/16 05/16 08/16 11/16 Percent of domains with DS and DNSKEY record Date .com .net .org .nl 10000 20000 30000 40000 50000 60000 70000 # of domains .com .net .org .nl

[3] Reseller (.com, .org, .net)

  • vs. Registrar (.nl)
slide-108
SLIDE 108

28

20 40 60 80 100 05/15 08/15 11/15 02/16 05/16 08/16 11/16 Percent of domains with DS and DNSKEY record Date .com .net .org .nl 10000 20000 30000 40000 50000 60000 70000 # of domains .com .net .org .nl

12/14

Changed their registrar to

  • ne that supports DNSSEC

[3] Reseller (.com, .org, .net)

  • vs. Registrar (.nl)
slide-109
SLIDE 109

28

20 40 60 80 100 05/15 08/15 11/15 02/16 05/16 08/16 11/16 Percent of domains with DS and DNSKEY record Date .com .net .org .nl 10000 20000 30000 40000 50000 60000 70000 # of domains .com .net .org .nl

Registrar

  • vs. Reseller

Complex relationship between reseller and registrar also result in slow deployment of DNSSEC

12/14

Changed their registrar to

  • ne that supports DNSSEC

[3] Reseller (.com, .org, .net)

  • vs. Registrar (.nl)
slide-110
SLIDE 110

DNS Operator

Third-Party

[4] Third-Party DNS Operator

29 29

Verisign Antagonist ASCIO Registry Registrar Reseller CloudFlare Owner Third-Party

DS Record DS Record DS Record DS Record DS Record

slide-111
SLIDE 111

0.2 0.4 0.6 0.8 1 1.2 02/16 05/16 08/16 11/16 Percent of domains with DNSKEY record Date 20 40 60 80 100 Percent of domains with DNSKEY that has DS record

[4] Third-Party DNS Operator <Cloudflare>

30 30 DS DNSKEY DNSKEY

slide-112
SLIDE 112

0.2 0.4 0.6 0.8 1 1.2 02/16 05/16 08/16 11/16 Percent of domains with DNSKEY record Date 20 40 60 80 100 Percent of domains with DNSKEY that has DS record

[4] Third-Party DNS Operator <Cloudflare>

30 30 DS DNSKEY DNSKEY

Cloudflare announced
 universal DNSSEC

slide-113
SLIDE 113

0.2 0.4 0.6 0.8 1 1.2 02/16 05/16 08/16 11/16 Percent of domains with DNSKEY record Date 20 40 60 80 100 Percent of domains with DNSKEY that has DS record

[4] Third-Party DNS Operator <Cloudflare>

30 30 DS DNSKEY DNSKEY

Cloudflare announced
 universal DNSSEC

slide-114
SLIDE 114

0.2 0.4 0.6 0.8 1 1.2 02/16 05/16 08/16 11/16 Percent of domains with DNSKEY record Date 20 40 60 80 100 Percent of domains with DNSKEY that has DS record

[4] Third-Party DNS Operator <Cloudflare>

30 30 DS DNSKEY DNSKEY

Cloudflare announced
 universal DNSSEC

slide-115
SLIDE 115

0.2 0.4 0.6 0.8 1 1.2 02/16 05/16 08/16 11/16 Percent of domains with DNSKEY record Date 20 40 60 80 100 Percent of domains with DNSKEY that has DS record

[4] Third-Party DNS Operator <Cloudflare>

30 30 DS DNSKEY

Third-party DNS Operator

Deploying DNSSEC is even harder for users using third-party DNS Operators

DNSKEY

Cloudflare announced
 universal DNSSEC

slide-116
SLIDE 116

Conclusion

31

slide-117
SLIDE 117

Conclusion

  • Registrars play a critical role in supporting DNSSEC today
  • Only 3 out of 20 registrars support DNSSEC on their

authoritative nameservers

  • Only 11 out of 20 registrars support uploading a custom DS

record

31

slide-118
SLIDE 118

Conclusion

  • Registrars play a critical role in supporting DNSSEC today
  • Only 3 out of 20 registrars support DNSSEC on their

authoritative nameservers

  • Only 11 out of 20 registrars support uploading a custom DS

record

31

  • DNSSEC deployment depends on many policies
  • Registrar: Free
  • Registry: Financial incentive
  • Reseller: Beware to choose a partner (i.e., registrar)
  • Third-party: CDS/CDNSKEY
slide-119
SLIDE 119

Thanks!

32

http://SecurePKI.org

Taejoong Chung http://tijay.me