Tue 2 Jun 2009
.ORG becomes the first open TLD to sign their zone with DNSSEC
Posted by Lauren Price under DNS Security (DNSSEC), Domain Names, Internet, Security
Today we reached a significant milestone in our effort to bolster online security for the .ORG community. We are the first open generic Top-Level Domain to successfully sign our zone with Domain Name Security Extensions (DNSSEC). To date, the .ORG zone is the largest domain registry to implement this needed security measure.
What does it mean that the .ORG Zone is “signed”? Signing our zone is the first part of our DNSSEC test phase. We are now cryptographically signing the authoritative data within the .ORG zone file. This process adds new records to the zone, which allows verification of the origin authenticity and integrity of data. In addition to zone signing, key maintenance will also be tested to include key generation, storage, and rollover. The final component of this initial test phase will be to sign domain names. We will test domain names in a controlled environment, starting first with a small set of names in which we will manually insert DS records into the zone. The focus of this first phase is proper testing to mitigate risks and capture lessons learned to share industry wide.
We believe that sharing lessons learned from our experiences will lead to even more consideration and adoption across the industry, bringing us to the “tipping point” where all Internet users can benefit from the trust and authentication that DNSSEC can offer.
For more detailed information about our DNSSEC initiative, please visit our website at http://pir.org/dnssec.
|
|
|
|
5 Responses to “ .ORG becomes the first open TLD to sign their zone with DNSSEC ”
Comments:
Leave a Reply
Trackbacks & Pingbacks:
-
Trackback from Josh's Blog
June 6th, 2009 at 8:36 pmSecurity Week in Review (2009-05-31)…
.ORG DNSSEC
This week .ORG became the first TLD to sign their zone with DNSSEC:
http://blog.pir.org/?p=349This is sort of a big deal, as most everyone agrees DNSSEC will happen in the future, but nobody has really taken any steps to make it happe…
-
Pingback from links for 2009-06-08 - [LINICKX].com
June 8th, 2009 at 8:59 pm[...] .ORG becomes the first open TLD to sign their zone with DNSSEC » The .ORG Blog ToDo: Investigate how to DNSSEC + linickx.com … the big question is not how hard but how much will it cost… certificates cost money, not something a small time blogger has to spare (tags: dnssec security dns) [...]
-
Pingback from Security Musings » Blog Archive » DNSSEC
June 9th, 2009 at 6:48 am[...] been in the news lately. Both the Root Domain and the .ORG domain are implementing DNSSEC. So what does that mean? It means that a lot of attacks that require [...]
June 2nd, 2009 at 2:25 pm
So, if I have a .org domain, how do I send you my key in order to get DS records in the .org zone?
July 16th, 2009 at 8:50 am
What is the purpose of signing ORG - which is quite a popular TLD - with NSEC3 key, whose implementations are very limited?
The main purpose for which I had to disable DNSSEC in my local DNS server was that most BSD and Linux stable distributions use BIND 9.5.x as main resolver.
With DNSSEC enabled the whole ORG tree was unavailable. Or maybe I don’t know a method to bypass DNSSEC validation just for ORG tree?