Topic: DNSSEC From 5 May 2010

[purvis]

This seemed to be the appropiate place to post what needed to be said.
The readers needed some background on what had already been posted.

This is no bug as far as i am concerned
it is about altering the setup of sme that may improve the way dns lookups are made by not pointing to the router.
 

[CharlieBrady]

it is about altering the setup of sme that may improve the way dns lookups are made by not pointing to the router.

So don't point to the router. SME server doesn't need to be pointed to anything for dns lookups (and this is true regardless of any DNSSEC chagnes from 5 May 2010).

[purvis]

I am going to do some more testing of my setting today and see what happens.
My machines are all running in server mode.

Charlie, after reviewing some post. I do not understand how your last comment can work.
Do you care to explain.
And because i might want to put in my own dns servers, what would be the format to put in multiple dns servers on the same line during the configuration process of the server.
Thanks.

[janet]

purvis

And because i might want to put in my own dns servers...

I think that is the point Charlie is making. SME server is very capable of doing DNS resolving all on its own, and you do not need to enter any DNS servers.
It has been said many times in these forums, and IIRC it even suggests to leave those fields blank when running the server configuration steps.

Search the forums on DNS for previous answers.

[Dan York]

For the sake of completeness, as I have a personal interest in getting a DNSSEC-aware resolver to work on SME Server, I will update this older thread with a few links links from January 2011 about djb and DNSSEC:

http://vimeo.com/18417770 - video of djb's talk at the 27th CCC ripping into DNSSEC and talking about his own proposed DNSCurve

http://dankaminsky.com/2011/01/05/djb-ccc/ - where Dan Kaminsky goes into great detail refuting many of the points that djb brings up (the comments are useful to read, too)

http://marc.info/?l=djbdns&m=129434351607605&w=2 - where djb refutes one of Dan K's points and dismisses much of that blog post as riddled with errors

http://dankaminsky.com/2011/01/07/cachewars/ - where Dan K responds

The net result of all of that is simply this -> I do not expect that we will ever see a DNSSEC implementation in djb's dnscache.

This is unfortunate as there is now (Jan 2012, a year after all those talks) much greater momentum behind DNSSEC - most of the major TLDs have signed their zones and each week brings news of more ccTLDs signing their zones. Comcast just made a huge announcement here in the US making DNSSEC-aware DNS resolvers available to their ~18 million customers. Many companies are looking into signing their domains.... and the movement continues...

However, djb's opinion of DNSSEC is EXTREMELY clear and for that reason I would not expect changes to dnscache.

For those of us who want DNSSEC, other options for DNS servers that support DNSSEC exist, of course, such as the Unbound name server ( http://unbound.net/ ) but that would involve more modification to SME Server than I personally am interested in undertaking.  So... no DNSSEC for now...

[CharlieBrady]

For the sake of completeness, as I have a personal interest in getting a DNSSEC-aware resolver to work on SME Server, I will update this older thread with a few links links from January 2011 about djb and DNSSEC:

Hi Dan! Thanks for doing this research and posting the summary here.

The net result of all of that is simply this -> I do not expect that we will ever see a DNSSEC implementation in djb's dnscache.

Certainly not by djb himself. dnscache has been placed in the public domain, so in theory somebody else could hack on dnscache and add DNSSEC. Not likely, but possible.

For those of us who want DNSSEC, other options for DNS servers that support DNSSEC exist, of course, such as the Unbound name server ( http://unbound.net/ ) but that would involve more modification to SME Server than I personally am interested in undertaking.  So... no DNSSEC for now...

I agree with you that Unbound looks the best candidate for this.

[chris burnat]

Moving to General Discussions