A Longitudinal, End-to-End View of the DNSSEC Ecosystem
summary
Longitudinal measurement of .com .org and .net over 21 months finds pervasive DNSSEC mismanagement: researchers collect daily snapshots of 147 million domains and actively test 59K DNS resolvers via the Illuminati proxy, build reproducible tests for malformed and expired signatures, and report that 30% missing DS records prevent validation while 12% of resolvers actually validate; 39% use weak KSKs and many keys are never rolled, motivating automation and registry-side support.
AI-written summary · about
chapters (25)
- 0:00Intro
- 0:31Domain Name System (DNS)
- 1:28DNS Spoofing
- 1:57DNSSEC 101
- 2:47Hierarchical Structure
- 5:08Summary of DNSSEC IOI
- 5:57Contribution
- 6:22Outline
- 6:43Correct Deployment for Authoritative Servers
- 8:37Missing RRSIG records
- 9:29Incorrect RRSIG records
- 10:00Missing DS records
- 10:31Incorrect DS records
- 10:51Choosing Authoritative Nameserver
- 11:37Why are DS records missing!
- 12:42Summary of DNSSEC Deployment
- 13:31Good Steps to Deploy DNSSEC
- 14:34Key Reuse
- 15:31Correct Deployment for Resolvers
- 15:45Measuring DNS resolver
- 17:21Methodology
- 19:12Open Resolver Tests
- 19:45Conclusion
- 20:28Recommendations
- 22:18Key Strength
