I'm using Fedora for desktop use and I:
yum -y install caching-nameserver
service named restart
chkconfig --level 5 named on
on it, and set the nameserver to 127.0.0.1. If I:
dig google.com | grep SERVER
;; SERVER: 127.0.0.1#53(127.0.0.1)
Then I can see it's ok … I'm using my previously installed local DNS cache server! Hurrah! (no more crappy DNS from my ISP..)
Then I tried tcpdump
:
tcpdump -n -i eth0 dst port 53
All I can see that my Local DNS server doesn't use my ISP's DNS server for resolving, rather it uses the root servers (IP address) DNS server to resolve my domain names (the ones I type in my webbrowser).
Question #1: Does my local DNS caching server really only uses just the root servers DNS server for resolving?
Question#2: If using DNSSEC gives me more security regarding DNS, then how could I set my pc/local dns cache to only use and only allow DNSSEC? I think DNSSEC is deployed years (?) ago on the root DNS servers.
Update: I had misunderstood something, and to use only DNSSEC I would need that: all the NS's of the domains that I'm visiting must be configured to use DNSSEC - and that's not very widely used, so I can't use only DNSSEC.