topic Re: Adding DNSSEC support to Sky DNS servers in Broadband

Adding DNSSEC support to Sky DNS servers

hgwv — Thu, 04 Apr 2024 18:46:21 GMT

I think it would be good if Sky added DNSSEC support to their DNS servers. DNSSEC is a technology that verifies DNS records have not been modified fraudulently by checking their authenticity.

Granted, users can configure their devices to use third-party public DNS servers, since they all support DNSSEC, but it would be nice to see first-party support as well.

The DNS query below should fail on a DNSSEC-aware DNS server due to an intentionally broken signature.

> Resolve-DnsName sigfail.ippacket.stream -server 8.8.8.8 Resolve-DnsName : sigfail.ippacket.stream : DNS server failure At line:1 char:1 + Resolve-DnsName sigfail.ippacket.stream -server 8.8.8.8 + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ResourceUnavailable: (sigfail.ippacket.stream:String) [Resolve-DnsName], Win32Exception + FullyQualifiedErrorId : RCODE_SERVER_FAILURE,Microsoft.DnsClient.Commands.ResolveDnsName

> Resolve-DnsName sigfail.ippacket.stream -server 90.207.238.97 Name Type TTL Section NameHost ---- ---- --- ------- -------- sigfail.ippacket.stream CNAME 60 Answer sigfail.rsa2048-sha256.ippacket.stream Name : sigfail.rsa2048-sha256.ippacket.stream QueryType : AAAA TTL : 60 Section : Answer IP6Address : 2a01:4f8:13b:2048::113 Name : sigfail.rsa2048-sha256.ippacket.stream QueryType : A TTL : 60 Section : Answer IP4Address : 195.201.14.36

Re: Adding DNSSEC support to Sky DNS servers

jamesn123 — Thu, 11 Apr 2024 09:43:37 GMT

@hgwv

I am sure Sky will be looking into doing it at some point. There is no need to post the same thing 3 times in 4 months.

Re: Adding DNSSEC support to Sky DNS servers

hgwv — Thu, 11 Apr 2024 09:49:34 GMT

@jamesn123 wrote:
@hgwv
I am sure Sky will be looking into doing it at some point.

What are you basing this assumption on?

Re: Adding DNSSEC support to Sky DNS servers

jamesn123 — Thu, 11 Apr 2024 09:59:13 GMT

@hgwv wrote:

@jamesn123 wrote:

@hgwv

I am sure Sky will be looking into doing it at some point.

What are you basing this assumption on?

The fact that DNSSEC is becoming more widely adopted and in the future its very likely to be a normal feature of a DNS server so it would be silly for Sky to not be looking into it.

Re: Adding DNSSEC support to Sky DNS servers

hgwv — Thu, 11 Apr 2024 10:10:08 GMT

@jamesn123 wrote:

The fact that DNSSEC is becoming more widely adopted and in the future its very likely to be a normal feature of a DNS server so it would be silly for Sky to not be looking into it.

It would be silly, yes. And yet it's 2024, DNSSEC has been around for many years, all the major public DNS resolvers have it enabled it. And yet Sky have not, and haven't even said anything publicly about enabling it, despite the obvious security benefits of validating DNS records.

Why do you think that is?

Re: Adding DNSSEC support to Sky DNS servers

jamesn123 — Thu, 11 Apr 2024 10:13:15 GMT

@hgwv

Simply compatibility.

Sky want minimal support cost overhead and adding DNSSEC at this stage could cause some devices to not work. It may also break functionality of products like Sky Shield.

I am not aware of many or any major ISPs supporting DNSSEC at this time. Even Zen who are known to be a more specialist ISP dont support DNSSEC afaik.

Re: Adding DNSSEC support to Sky DNS servers

hgwv — Thu, 11 Apr 2024 10:17:22 GMT

So based on what you just said, arguing there are potentially valid reasons for not implementing DNSSEC on Sky's resolvers, are you still sure Sky will be looking to implement it at some point?

Re: Adding DNSSEC support to Sky DNS servers

jamesn123 — Thu, 11 Apr 2024 10:20:37 GMT

@hgwv wrote:

So based on what you just said, arguing there are potentially valid reasons for not implementing DNSSEC on Sky's resolvers, are you still sure Sky will be looking to implement it at some point?

Yes. Which is why I said 'at this stage'. As the technology matures & as Sky do more research and testing on the technology I am sure it will slowly trickle down. I know DNSSEC has been around for 10+ years but its adoption has been slow and it has not been as popular as developments like WiFi 6, WPA3 etc.

Re: Adding DNSSEC support to Sky DNS servers

hgwv — Thu, 11 Apr 2024 10:22:36 GMT

Do Superusers have any ability to ask Sky staff questions about things such as plans for DNSSEC rollout?

Re: Adding DNSSEC support to Sky DNS servers

jamesn123 — Thu, 11 Apr 2024 10:24:58 GMT

@hgwv

We have a private board in which we can propose questions to Sky Staff however we are not guaranteed an answer from them nor are the Staff able to provide insights into everything Sky are doing.

Re: Adding DNSSEC support to Sky DNS servers

hgwv — Thu, 11 Apr 2024 10:25:32 GMT

Are you willing to post my question to that board?

Re: Adding DNSSEC support to Sky DNS servers

jamesn123 — Thu, 11 Apr 2024 10:27:29 GMT

@hgwv

I can certainly try and get an answer for you but like I said it is not guaranteed

Re: Adding DNSSEC support to Sky DNS servers

hgwv — Thu, 11 Apr 2024 10:30:51 GMT

Appreciated. I also think demonstrating customer demand is another way Sky might take notice. I know it is unlikely Sky staff with any authority over the DNS resolvers will read my posts, but there's a small chance.

Re: Adding DNSSEC support to Sky DNS servers

lettice — Thu, 11 Apr 2024 10:56:01 GMT

Not aware of any isp that have implemented this as you are 'basically' proposing.

It would be a complex task, break a lot of current traffic for the UK based customer via isp and a lot of the backend tools of the ISs would most probably need to be re-engineered. That I feel would be a major task and is probably part of their ongoing product upgrade plan anyway.

There are many ways to avoid such pass throughs and I expect Sky, their partners and other ISPs already have them active on their networks to protect customers.

Re: Adding DNSSEC support to Sky DNS servers

hgwv — Thu, 11 Apr 2024 11:12:28 GMT

@lettice I do not share your pessimism over DNSSEC. All of the public DNS resolvers enabled DNSSEC a long time ago and when using them everything works as before, except that when I resolve domains with DNSSEC enabled I have an assurance the DNS records are genuine.