DNSSEC in the root zone? How to use it?

Question

I'm using Fedora for desktop use and I:

yum -y install caching-nameserver
service named restart
chkconfig --level 5 named on

on it, and set the nameserver to 127.0.0.1. If I:

dig google.com | grep SERVER
;; SERVER: 127.0.0.1#53(127.0.0.1)

Then I can see it's ok … I'm using my previously installed local DNS cache server! Hurrah! (no more crappy DNS from my ISP..)

Then I tried tcpdump:

tcpdump -n -i eth0 dst port 53

All I can see that my Local DNS server doesn't use my ISP's DNS server for resolving, rather it uses the root servers (IP address) DNS server to resolve my domain names (the ones I type in my webbrowser).

Question #1: Does my local DNS caching server really only uses just the root servers DNS server for resolving?

Question#2: If using DNSSEC gives me more security regarding DNS, then how could I set my pc/local dns cache to only use and only allow DNSSEC? I think DNSSEC is deployed years (?) ago on the root DNS servers.

Update: I had misunderstood something, and to use only DNSSEC I would need that: all the NS's of the domains that I'm visiting must be configured to use DNSSEC - and that's not very widely used, so I can't use only DNSSEC.

Answer 1

1. The local resolver you've set up will not use your ISP's resolver at all by default. It'll starting asking the root directly for answers for everything it needs. The root will hand back answers that say things like "I don't know where www.example.com is; you should go talk to com and here are a set of addresses for how to talk to com" (and off you'd go trying to talk to com, which would refer you to example.com)". In the end, you'll follow the chain until you got your answer. If you ever needed to find ftp.example.com, your local resolver would have a "cache" that will allow it to go straight to the example.com servers, or if you wanted foo.com it would go straight to the com servers and wouldn't ask the root.

2. For DNSSEC, much of the world has deployed it from the top down but the lower domains haven't. The root has been signed, com has been signed, net has been signed, etc. But facebook.com, google.com, etc hasn't. Fortunately DNSSEC has been designed to allow for this and software that tries to securely follow DNS records will eventually get to a nameserver (com for examplethat says "I don't know wherewww.facebook.comis and you should go talk tofacebook.com` and oh, by the way, they're not secured yet". IE, DNSSEC offers you something called provably insecure. This lets you know with certainty that a parent of a zone says the child isn't signed (which is a simplification; they could have signed but not "chained" yet).

It's worth noting that DNSSEC is not enabled by default and you need to turn it on within the bind configuration files. I think the default fedora named.conf now has DNSSEC enabled, but you should check. In your named.conf file you'll find hopefully a section that has a trusted-key for the root:

trusted-keys {
  . 257 3 8 "AwEAAagAIKlVZr...";
}

And an options section that turns on DNSSEC validation:

options {
    dnssec-enable yes;
    dnssec-validation yes;
};

With this on, if you do a dig +dnssec www.dnssec-tools.org, for example, you should see the AD flag returned in the output. The AD flag means that the record has been verified through DNSSEC. If you search for www.facebook.com you won't see this flag.

# dig +dnssec www.dnssec-tools.org
...
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
                   ^^
                   ^^

Answer 2

You should configure forwarders in you local server to point to your ISP servers. You could also set forward-only.

Not sure about #2.