Most Middle East Domains Still Lack DNSSEC Protection

DNS security and privacy in the Middle East received a practical check-up at the e-AGE18 conference in Amman, Jordan on 2-3 December 2018, where the Internet Society outlined how DNSSEC, encrypted DNS and a looming DNS Flag Day would affect network operators and website owners. DNSSEC, short for Domain Name System Security Extensions, is a set of checks that lets a DNS resolver verify that the answer to a DNS query really comes from the domain's owner and has not been changed along the way. Kevin Meynell from the Internet Society's Middle East Bureau described how this chain-of-trust reduces the risk of spoofing, where incorrect data is slipped into a resolver, and man-in-the-middle attacks, where queries are redirected to a name server that returns forged responses.

However, the Middle East has a long way to go. Only the Saudi Arabia country-code top-level domain (.sa) had operationally deployed DNSSEC at the time of the conference. Iran (.ir) and Iraq (.iq) had deployed it on an experimental basis. The picture is brighter for validation: around 18% of DNS queries originating from Middle East countries were being validated, compared with 12% globally. Yemen led with 45.1%, followed by Saudi Arabia at 32.1%, Iraq at 30.6%, Bahrain at 23.2% and Palestine at 22.5%. Meynell suggested this might be because many users in the region rely on third-party DNS resolvers such as Cloudflare, Google and Quad9, which already perform DNSSEC validation.

DNSSEC only proves that records have not been modified; it does not hide what a user is looking up. By default, DNS queries are sent in clear text, so anyone on the path can eavesdrop. The IETF DPRIVE Working Group has developed encryption mechanisms to address this: DNS-over-TLS (DoT), DNS-over-DTLS (DoD) and DNS-over-HTTPS (DoH). All but DoD are already supported by public resolvers including Cloudflare, Quad9 and CleanBrowsing, and by clients such as Stubby 1.3+, Unbound 1.6.7+, Knot 2.0+, Mozilla Firefox 62+ and Android 9 Pie. The presentation stressed that clients and resolvers both need to be upgraded to use DoT or DoH. Importantly, these mechanisms only encrypt the path between a user's device (the stub resolver) and the recursive resolver, not the path between the recursive resolver and authoritative DNS servers. Encrypting that second leg would require every authoritative server to support DoT and DoH, and there are concerns about the extra computing load on heavily used name servers. In addition, the operator of a recursive resolver can still monitor and log queries and responses, so that operator must be trusted.

DNS Flag Day was another warning raised at e-AGE18. Extended DNS features, including DNSSEC, rely on EDNS0 (Extension Mechanisms for DNS, defined in RFC 6891). A properly implemented name server should either answer with an EDNS0-compliant response or fall back to a regular DNS response if it does not understand the extension. Many name servers are not implemented correctly, which forced resolvers to include workarounds. Those workarounds cause unnecessary retries and delays and block newer DNS features. The vendors behind the most widely used DNS server software, BIND, Unbound, PowerDNS and Knot, announced they would remove these workarounds on 1 February 2019. After that date, hostnames served by broken DNS implementations would no longer resolve. Meynell urged domain owners to check whether their domains were affected.

The e-AGE18 conference was organised by the Arab States Research and Education Network (ASREN), a non-profit association of National Research and Education Networks in the Middle East, and co-sponsored by the Internet Society. ASREN's mandate covers 22 countries, and it has partnered with regional research and education networking initiatives elsewhere: GÉANT in Europe, Internet2 in the United States, CANARIE in Canada, WACREN in West Africa and RedCLARA in Latin America. International connectivity is supported by the EU-funded EUMEDConnect3 project. The Internet Society's Deploy360 programme also offers resources to help network operators deploy DNSSEC.

For readers who run websites or manage networks, the session offered clear actions. DNSSEC authenticates records, encrypted DNS protects query confidentiality, and DNS Flag Day forced operators to fix broken implementations. Using a private, encrypted DNS resolver such as AEU DNS is one practical step that helps keep the first leg of a DNS query confidential, while DNSSEC and DNS Flag Day preparation remain separate tasks.