>Since Quad9 already performs DNSSEC validation, DNSSEC being enabled in the forwarder will cause a duplication of the DNSSEC process, significantly reducing performance and potentially causing false BOGUS responses.
This sounds dodgy. Surely that means Quad9 can poison my DNS?
Haven't had time to study the bug and really understand the whole issue myself. Just left it there with the takeaway that local validation is currently not for non-experts.
(Sorry not at my computer. Details rather vague from memory.)
What's the specific threat you're envisioning? If it involves Quad9 themselves being malicious, what would DNSSEC on the forwarding prevent?
This page explains how all of this works in detail: https://quad9.net/news/blog/quad9-enables-dnssec-on-all-serv...
I've always been of two minds on this. On one hand, that concern is beyond any reasonable level of security/performance/reliability tradeoff for most any user. At the same time, it is a bit of a shame DNS doesn't have a more scalable & performant approach to security which can just always be done without having to consider it a tradeoff, however minor in practice.
1. The forwarder gets a response claiming the record is supposed to be DNNSEC signed from the parent (recursively traversing from the root). The forwarder checks the signature of this claim. If the signature is valid, the forwarder continues on to validate the signature of the record and checks its validity to know if the info was secure. If the signature is invalid, the forwarder knows any information any information is not able to be validated as secure
- Somewhere during the recursive checks through the root, the forwarder gets an unsigned (no DNSSEC) or invalidly signed (e.g. your stripped response) response. The forwarder knows any information is not able to be validated as secure.
- A claim for lack of configuration or support of DNSSEC records comes back. The forwarder knows any information is not able to be validated as secure.
So you always know whether or not the information was secure, it's just if it was insecure you don't know if it's because it was just never secured or if someone tried to tamper with it. And that should make sense, an insecure message is by definition one which you can't tell if it has been tampered with.
Can you be more specific about how, using current DNS software, that downstream resolver can reliably detect whether a zone is DNSSEC signed? The upstream recurser can erase every DNSSEC record in the tree if it wants. What does the downstream recurser do short of jettisoning the upstream and doing all its own recursive lookups?
1) The signature chain checks out all the way to the root, who's key info comes from a file included the DNS software rather than a DNSSEC query. The integrity of the end record is trusted (not the upstream itself) and the process is complete.
2) The signature chain checks out but part way down it (explicitly) ends early. E.g. "example" is not configured for DNSSEC but "com" and "." are so .com ends the signature chain with a signed "example will not be signed" handoff. The process is complete, the record is securely known to be insecurely defined by the authoritative servers for "example" per the signatures from the .com records and the local security anchor (e.g. bind.keys file)
3) The signature chain doesn't validate at some point. This could be because the malicious upstream tried to modify a record or it could be because the malicious upstream tried to fake lack of record response even though it can't fake the parent domain's signature of that (recursively to the root because the root keys are local to the server). In this case, the invalid records from the malicious upstream are jettisoned in favor of trying to get valid responses via recursive resolution.
.
Tying it all back together: Because the downstream forwarder is only looking for the signature chain to trust the record, it just wants to get those records as fast as possible. BIND determines the most likely way to get a quick response is to ask the forwarder. It then checks the full signature of all of these, almost always bind was right - the forwarder had the records needed cached and didn't try to modify them. If the forwarder was malicious or just in error bind throws these away and tries to recurse the answer directly.
Quad9 wants people to disable it because it's extra record requests, most people don't care, and, if you trust Quad9, you can just send your request in a DoH or DoT tunnel to secure the last hop more efficiently while they do the validation of the record itself.
The question is how DNSSEC breaks down in the last mile, where recursive lookups aren't happening. A stub resolver --- every resolver on an ordinary workstation is a stub resolver --- can absolutely be tricked by its upstream DNS server. Quad9 can lie to clients about whether it validated DNSSEC, or whether DNSSEC was present at all.
Perhaps the confusion comes from the context of the above being "what Quad9 says to do to your forwarder's DNSSEC configuration" and it'd be easier to ask this question with a fully fresh situation & context?
To protect yourself from an upstream resolver using DNSSEC, you need to be doing something akin to a full recursive lookup yourself. This is a flaw in the DNSSEC design and a reason why DoH took off instead.
What? I don't see how you can call that a flaw in DNSSEC when DoH is no better in this regard; it doesn't even attempt to protect against a malicious recursive resolver. The only way to do that is to validate DNSSEC on the client.