https://emanuelduss.ch/tags/dnssec/ Recent content in Dnssec on emanuelduss.ch Hugo -- 0.154.5 en-us Mon, 20 Apr 2020 06:56:01 +0000 https://emanuelduss.ch/posts/some-dnssec-nsec-experiments-starting-at-the-root-zone/ Mon, 20 Apr 2020 06:56:01 +0000 https://emanuelduss.ch/posts/some-dnssec-nsec-experiments-starting-at-the-root-zone/ <h2 id="introduction">Introduction</h2> <p>I was recently playing around with DNSSEC and figured out that the root DNS zone <code>.</code> uses NSEC and not NSEC3 to prove the absence of a resource record. This looked interesting to me and triggered some ideas. So I did some experiments and here are the results.</p> <p><img loading="lazy" src="https://emanuelduss.ch/posts/some-dnssec-nsec-experiments-starting-at-the-root-zone/ldns-walk.png"></p> <h2 id="tldr">TL;Dr:</h2> <p>The most interesting facts:</p> <ul> <li>The root DNS zone uses NSEC can be therefore be DNSSEC zone walked</li> <li>There are more than 1500 TLDs</li> <li>More than 90% of all TLDs haven DNSSEC configured</li> <li>The most used algorithm for signing DNS zones is RSA/SHA-256</li> <li>53 TLDs also use NSEC and can therefore also be DNSSEC zone walked</li> </ul> <p>Note: The results may not be exactly accurate because it was not always verified if every query was always successful.</p>