A Case for Comprehensive DNSSEC Monitoring and Analysis Tools

The Domain Name System Security Extensions (DNSSEC) add an element of authentication to the DNS, which is a foundational component of today’s Internet. However, the complexity involved in maintaining a DNSSEC deployment is significantly more than that of its insecure counterpart, and there are more places where problems can occur. Our analysis shows that errors in DNSSEC configuration have been pervasive and have affected DNS namespace at even the highest levels. Effective tools are necessary to recognize, diagnose, and help correct such errors both for administrators of authoritative name servers and of validating resolvers. In this paper we identify some of the issues impacting DNSSEC deployments, analyze their pervasiveness in production DNS, and describe tool functionality that can help administrators understand, maintain, and troubleshoot DNSSEC deployments at both the validating resolvers and authoritative servers.