Why is DNSSEC Important? (Why Should I Care?)
You might be thinking to yourself: all this DNSSEC stuff sounds
wonderful, but why should I care? Below are some reasons why you may want to
consider deploying DNSSEC:
- Be a good netizen: By enabling DNSSEC
validation (as described in Chapter 3, Validation) on your
DNS servers, you're protecting your users or yourself a little more by
checking answers returned to you; by signing your zones (as described in
Chapter 4, Signing), you are making it possible for other
people to verify your zone data. As more people adopt DNSSEC, the Internet
as a whole becomes more secure for everyone.
- Compliance: You may not even get a say
whether or not you want to implement DNSSEC, if your organization is
subject to compliance standards that mandate it. For example, the US
government set a deadline back in 2008, to have all
.gov sub
domains signed by the December 2009 . So if you operated a sub domain in
.gov, you must implement DNSSEC in order to be compliant. One
of the widely used compliance standards, PCI DSS for the payment card
industry, has been rumored to list DNSSEC as a requirement or
recommendation, as part of its on-going efforts to enhance security for
online payment transactions.
ICANN also requires that all new top-level domains support DNSSEC. - Enhanced Security (C.Y.A.) : Okay, so the
big lofty goal of "let's be good" doesn't appeal to you, and you don't have
any compliance standards to worry about . Here is a more practical reason
why you should consider DNSSEC: in case of a DNS-based security breach,
such as cache poisoning or domain hijacking, after all the financial and
brand damage done to your domain name, you might be placed under scrutiny
for any preventative measure that could have been put in place. Think of
this like having your web site only available via HTTP but not
HTTPS.
- New Features: DNSSEC brings not only enhanced
security, but with that new level of security, a whole new suite of
features. Once DNS can be trusted completely, it becomes possible to
publish SSL certificates in DNS, or PGP keys for fully automatic
cross-platform email encryption, or SSH fingerprints... People are still
coming up with new features, but this all relies on a trust-worthy DNS
infrastructure. To take a peek at these next generation DNS features, check
out the section called “Introduction to DANE”.
Gab
Twitter