Adding DNSSEC support to Sky DNS servers

[hgwv]

I think it would be good if Sky added DNSSEC support to their DNS servers. DNSSEC is a technology that verifies DNS records have not been modified fraudulently by checking their authenticity.

Granted, users can configure their devices to use third-party public DNS servers, since they all support DNSSEC, but it would be nice to see first-party support as well.

The DNS query below should fail on a DNSSEC-aware DNS server due to an intentionally broken signature.

> Resolve-DnsName sigfail.ippacket.stream -server 8.8.8.8
Resolve-DnsName : sigfail.ippacket.stream : DNS server failure
At line:1 char:1
+ Resolve-DnsName sigfail.ippacket.stream -server 8.8.8.8
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (sigfail.ippacket.stream:String) [Resolve-DnsName], Win32Exception
    + FullyQualifiedErrorId : RCODE_SERVER_FAILURE,Microsoft.DnsClient.Commands.ResolveDnsName

> Resolve-DnsName sigfail.ippacket.stream -server 90.207.238.97

Name                           Type   TTL   Section    NameHost
----                           ----   ---   -------    --------
sigfail.ippacket.stream        CNAME  60    Answer     sigfail.rsa2048-sha256.ippacket.stream

Name       : sigfail.rsa2048-sha256.ippacket.stream
QueryType  : AAAA
TTL        : 60
Section    : Answer
IP6Address : 2a01:4f8:13b:2048::113


Name       : sigfail.rsa2048-sha256.ippacket.stream
QueryType  : A
TTL        : 60
Section    : Answer
IP4Address : 195.201.14.36

[jamesn123]

@hgwv 

I am sure Sky will be looking into doing it at some point. There is no need to post the same thing 3 times in 4 months.

[hgwv]

---

@jamesn123 wrote:

@hgwv 

I am sure Sky will be looking into doing it at some point.

---

What are you basing this assumption on?

[jamesn123]

---

@hgwv wrote:

---

@jamesn123 wrote:

@hgwv 

I am sure Sky will be looking into doing it at some point.

---

What are you basing this assumption on?

---

The fact that DNSSEC is becoming more widely adopted and in the future its very likely to be a normal feature of a DNS server so it would be silly for Sky to not be looking into it. 

[hgwv]

---

@jamesn123 wrote:

The fact that DNSSEC is becoming more widely adopted and in the future its very likely to be a normal feature of a DNS server so it would be silly for Sky to not be looking into it. 

---

It would be silly, yes. And yet it's 2024, DNSSEC has been around for many years, all the major public DNS resolvers have it enabled it. And yet Sky have not, and haven't even said anything publicly about enabling it, despite the obvious security benefits of validating DNS records.

Why do you think that is?

[jamesn123]

@hgwv 

Simply compatibility.

Sky want minimal support cost overhead and adding DNSSEC at this stage could cause some devices to not work. It may also break functionality of products like Sky Shield. 

I am not aware of many or any major ISPs supporting DNSSEC at this time. Even Zen who are known to be a more specialist ISP dont support DNSSEC afaik. 

[hgwv]

So based on what you just said, arguing there are potentially valid reasons for not implementing DNSSEC on Sky's resolvers, are you still sure Sky will be looking to implement it at some point?

[jamesn123]

---

@hgwv wrote:

So based on what you just said, arguing there are potentially valid reasons for not implementing DNSSEC on Sky's resolvers, are you still sure Sky will be looking to implement it at some point?

---

Yes. Which is why I said 'at this stage'. As the technology matures & as Sky do more research and testing on the technology I am sure it will slowly trickle down. I know DNSSEC has been around for 10+ years but its adoption has been slow and it has not been as popular as developments like WiFi 6, WPA3 etc.

[hgwv]

Do Superusers have any ability to ask Sky staff questions about things such as plans for DNSSEC rollout?

[jamesn123]

@hgwv 

We have a private board in which we can propose questions to Sky Staff however we are not guaranteed an answer from them nor are the Staff able to provide insights into everything Sky are doing.

[hgwv]

Are you willing to post my question to that board?

[jamesn123]

@hgwv 

I can certainly try and get an answer for you but like I said it is not guaranteed

[hgwv]

Appreciated. I also think demonstrating customer demand is another way Sky might take notice. I know it is unlikely Sky staff with any authority over the DNS resolvers will read my posts, but there's a small chance.

[lettice]

Not aware of any isp that have implemented this as you are 'basically' proposing.

It would be a complex task, break a lot of current traffic for the UK based customer via isp and a lot of the backend tools of the ISs would most probably need to be re-engineered. That I feel would be a major task and is probably part of their ongoing product upgrade plan anyway.

There are many ways to avoid such pass throughs and I expect Sky, their partners and other ISPs already have them active on their networks to protect customers.

[hgwv]

@lettice  I do not share your pessimism over DNSSEC. All of the public DNS resolvers enabled DNSSEC a long time ago and when using them everything works as before, except that when I resolve domains with DNSSEC enabled I have an assurance the DNS records are genuine.