Home / server / Questions / 134381
Accepted
pQd
Asked: 2010-04-22 03:02:20 +0800 CST

windows 2003 DNS server and DNS SEC

  • 772

i have almost out-of-the-box windows 2003 server which is also domain name server for some users. should i be worried of 5th of may's deployment of dnssec on root name servers ?

i have already run:

dnscmd /Config /EnableEDnsProbes 1

thanks a lot!

ps. my firewalls / network infrastructure do not block udp packets > 512B

my result from ripe test:

Announced buffer size: 1280 bytes

Measured buffer size: 1259 bytes

EDNS enabled: yes

DNSSEC enabled: no

Your resolver does not have DNSSEC enabled.

Note: There will always be a difference between the announced and measured buffer size because of the algorithm used. However this difference should not exceed 300 bytes.

ps #2

this is active directory server so it has dns service which is authoritative dns server for some internal dns zone [not used in public internet]. this server is also used as recursive name server for some internal users.

windows-server-2003 domain-name-system dnssec

3 Answers

  1. I would think that you would need to worry only if two things apply to your situation:

    1. You use the root hint servers instead of forwarders

    2. Your firewall blocks DNS UDP packets larger than 512 bytes

    I know that my firewalls don't support DNS UDP packets larger than 512 bytes so I've switched from using the root hint servers to using Google's public DNS servers for external DNS queries.

    • 1

  2. I think best would be you try the tests Ripe explains here, then you may see whether you need to do anything on your server or your firewalls. Everything else would be guess work from my point of view.

    If your users are connected by router themselves they should also try the tests, whether the DNS Queries will work. I have a Fritz Router and I needed to apply a workaround as the router only supports up to 512Byte DNS packages.

    • 1
  3. Best Answer

    From what you've said I'm presuming that this is a recursive server, and not an authoritative server.

    From the details given, you should have no problems. Your network apparently supports responses > 512 bytes, and your server supports EDNS0.

    In any event, you will only ever have problems if your server sends queries to external servers that have the DO bit (DNSSEC OK) set.

    Without that flag all responses from the root servers (and any other authoritative servers for that matter) will look exactly the same come May 5th as they did before DNSSEC.

    The only other thing you should check is that your network permits outbound DNS queries to work over TCP - so don't ever block outbound tcp/53 on your firewall.

    If you need more help, please ask. I'm the author of various ICANN and IETF documents relating to this issue.

    • 1