nsd users - Mar 2019 - DoT on the Auth side?

Hi Fredrik,

DoT is most useful between stub resolvers and their upstream recursive
resolvers, because this is the path that is most often snooped and
mangled by men-in-the-middle.

NSD is an authoritative DNS server, so its clients are going to be
regular recursive resolvers. While DoT would also provide privacy and
authenticity on this path, it is not so important, yet. And trying to do
this requires solutions for a random recursive resolver to figure out
how to trust a random authoritative server's certificate.

I don't see an immediate need for DoT support in NSD (or any
authoritative server). As far as I remember, there are also no plans in
NSD for this, but I'm sure the developers will correct me if I'm wrong.

Regards,
Anand

On 15/03/2019 09:44, Fredrik Pettai wrote:
> Hi,
> 
> I saw this some time ago and then forgot about it...
> 
> https://code.fb.com/security/dns-over-tls/
> 
> Is this something that NSD is considering supporting (enable DoT on the
> auth side)?
> 
> I've been away from the various DNS working groups & forums for
some
> time now, so I don't know how this was received by the various groups?
> Generally positive, negative or neutral?
> 
> Re,
> 
> /P
> 
> 
> _______________________________________________
> nsd-users mailing list
> nsd-users at NLnetLabs.nl
> https://open.nlnetlabs.nl/mailman/listinfo/nsd-users
>

Am 15.03.19 um 11:10 schrieb Anand Buddhdev:
> DoT is most useful between stub resolvers and their upstream recursive
> resolvers, because this is the path that is most often snooped and
> mangled by men-in-the-middle.
it's correct. DoT between resolver and authoritative DNS servers is not
finally specified.
But there is desire to use similar technology.

Attached a patch that enable TLS support in unbound. I'm currently unsure
about the author (not my self)
Maybe the maintainer like to give that patch a chance.

Andreas
-------------- next part --------------
A non-text attachment was scrubbed...
Name: nsd-tls-4.1.26.patch
Type: text/x-patch
Size: 39748 bytes
Desc: not available
URL:
<http://lists.nlnetlabs.nl/pipermail/nsd-users/attachments/20190315/a59fa0ad/attachment.bin>