Home / server / Questions / 685563
Accepted
ericx
Asked: 2015-04-26 07:59:07 +0800 CST

using DNSSEC lookaside because registrar cannot inject DS records

  • 772

I love my registrar (whom I will not name); but they are currently only able to sign and post my KSK DS records for .com and .net and those are only sign'able by email to "[email protected]" (no API). While I don't use any "exotic" TLD's, the lack of support for .org is troublesome.

At this late date (April 2015), is it appropriate to use the ISC's look-aside for my .org domains?

Is anyone still using the look-aside? Or should everyone actually still be using the look-aside?

Is my loyalty to my registrar misdirected? Or should I simply transfer my domains to someone with better tech?

dnssec

1 Answers

  1. Best Answer

    Parts of the question are clearly opinion based but I'll try to address the specifics of relying on DNSSEC lookaside (DLV) at this time.


    First of all, lookaside support is implemented in several of the major validating resolver software implementations but not all. Even where the software implements lookaside support it is not generally enabled by default (probably as its use is not entirely without controversy - not a "real standard", central repository of trusted keys, etc.).

    Nowadays, with the root as well as most of the TLDs signed (and hopefully allowing creation of signed delegations) I don't think it's far-fetched to assume that adoption of lookaside in new deployments is likely dropping a lot except in cases where the system owner themselves are relying on lookaside for their own needs.

    As a couple of examples of some popular validating resolver servers, Google's public resolvers do not make use lookaside, neither does Comcast's.

    Overall, it would seem that lookaside is still better than nothing in that it's still potentially useful even though it seems like its usefulness is dropping.

    If possible (ie, if you have any idea which resolver servers most of your clients will be using), you may want to do some testing to figure out how useful relying on DNSSEC lookaside is for you specifically. Querying validating resolver servers for eg nsec3.dlvtest.dns-oarc.net (and observing the AD flag in the response) would be a good start.


    Some potentially useful reading (although a couple of years old):
    • 1