Networking/NameResolution/DNSSEC/OtherOSes

Overview of DNSSEC support in operating systems

Date: 2016-01-06

Windows

Windows clients as shipped by Microsoft cannot do DNSSEC validation locally. DNSSEC validation can be explicitly enabled for certain sub-domains in “Name Resolution Policy Table“ but all clients depend on remote servers for validation. This policy can be centrally managed using Group Policies.

This can be secure only if the remote server is always reachable over IPSec tunnel. Windows clients have means to enforce that:

• https://technet.microsoft.com/en-us/library/ee649207%28v=ws.10%29.aspx

Personally I believe that this is unworkable when Captive portals are in play but might be good enough for data centres.

System-level validation and captive portal handling can be enforced using the same manual configuration of Unbound+dnssec trigger as in current Linux distributions.

OS X & iOS

Neither OS X nor iOS do DNSSEC validation by default, but has some low-level APIs provided by mDNSResponder which can be used by applications to request DNSSEC validation.

Source:

• http://www.opensource.apple.com/source/mDNSResponder/mDNSResponder-544/mDNSCore/dnssec.h

• kDNSServiceFlagsValidate flag documented in https://developer.apple.com/library/ios/documentation/Networking/Reference/DNSServiceDiscovery_CRef/#//apple_ref/doc/constant_group/General_flags

Validation is not done by default and I was not able to find any system-level configuration for mDNSResponder.

System-level validation and captive portal handling can be enforced using the same manual configuration of Unbound+dnssec trigger as in current Linux distributions.

Sources:

• http://apple.stackexchange.com/questions/179134/how-do-i-enable-dnssec-on-osx-or-dnscurve
• http://stackoverflow.com/questions/31043217/how-to-enable-unbound-dnssec-dns-resolver-on-mac-os-x-10-10-3-yosemite

• http://www.macrumors.com/2015/06/30/apple-releases-os-x-10-10-4/

Android

I was not able any mention about DNSSEC on developer.android.com. There is community attempt to port Unbound + functionality of dnssec-trigger to Android:

• https://github.com/smarek/android-unbound-dns

Summary

• None of studied systems (Windows clients, Android, iOS & OS X) do DNSSEC validation by default. Support for DNSSEC, if present, is well hidden from users and buried in low-level APIs.
• No automatic workarounds for broken or misconfigured networks are available. This effectively means that ~ 60 % of clients would not be able to do DNSSEC validation reliably:
  • http://www.nlnetlabs.nl/downloads/publications/os3-2015-rp2-xavier-torrent-gorjon.pdf

Author: Pspacek (talk) 12:16, 6 January 2016 (UTC)