Functional overview
This test aims to confirm whether resolvers are resolving requests for domain names with DNS zones not signed with DNSSEC yet containing a valid Registrar DS record for a range of different algorithm / key strength values.
A successful test outcome would be registered if for a configured A record, requests for an A record for the domain name is received from the resolver but the resulting HTTP request is not successful as this would indicate that the resolver is verifying the DS record before proceeding.
Implementation
In order to track unique requests and avoid caching issues the Client Side Website Toolkit (CSWT) will send HTTP requests of the format
UUID.DOMAIN_NAME
Where the UUID is generated uniquely for each request. The SSCRT configures the DNS zone for the domain name with a wildcard IPv4 A record and sets up a wildcard SSL cert and matching web server virtual host for *.DOMAIN_NAME. The zone is then signed using the algorithm under test and a matching DS record is generated for use bu
After observing a DNS request for the full A record (including UUID prefix) the SSCRT will expect not to receive a valid HTTP request for the full record (including UUID prefix). If these criteria are met the test will be recorded as Successful.
Configuring test sessions
Before creating a DNSSEC test session for a domain it is essential that all DS records are removed at the registrar for that domain to ensure a clean environment.
DNSSEC test sessions are configured using the test key dnssec-unsigned which should be supplied when creating new sessions on the SSCRT along with an algorithm and optional key strength e.g.
resolvertest install dnssec-unsigned example.com ALGORITHM KEYSTRENGTH
ALGORITHM is one of 2,3,5,6,7,8,10,12,13,14,15,16
KEYSTRENGTH is optional and defaults to a sensible numeric value for a given algorithm but can be overridden if required - e.g. 1024, 2048
In order to complete configuration for DNSSEC validation tests it is necessary to add DS records to the domain registrar for the domain. Instructions for this will be printed at the end of the install process for the test but can also be viewed later by reviewing the Additional Info column for the test returned using the list command
resolvertest list
Tests can be invoked using the CSWT.
e.g.
let test = new ResolverCapabilityTest(“dnssec-unsigned”, “example.com”);
Log format
The log output for DNSSEC tests will contain the following distinct fields:
id - A unique numerical id for the log entry
date - The date and time of the combined log entry.
status - Either “Success” or “Failed” depending upon whether the client resolver correctly validated DNSSEC for the given test configuration - i.e. an A record lookup was made but no HTTP request.
dnsResolutionTime1 - The date and time that an A record DNS query was received for UUID.DOMAIN_NAME
dnsResolvedHostname1 -should generally be set to UUID.DOMAIN_NAME
dnsClientIpAddress1 - The IPv4 address of the client resolver or the /24 depending upon the configured privacy setting in the SSCRT.
dnsResolverQuery1 - The full query string made by the resolver for the resolution of the A record DNS query for UUID.DOMAIN_NAME
webServerRequestTime1 - The date and time that the HTTP request was made for UUID.DOMAIN_NAME if a request was received (Failed test)
webServerRequestHostname1- This will be set to UUID.DOMAIN_NAME if an HTTP request was received
webServerClientIpAddress1- The IPv4 address of the client machine (web browser) or the /24 depending upon the configured privacy setting in the SSCRT if this request was made.
webServerResponseCode1 - The HTTP response code returned from the web server - generally should be 200 if the request was received