"I was the only person who could make changes on our old DNS solution but now customers can manage their own DNS space."
Paul Schuur, Senior Consultant, Qwise BV, Netherlands
"DNSBOX can be managed by non-professional technicians. Just teach them a few quick steps then off they go"
Naif Orabi, Network Administrator at TAIF Ministry Of Education, Saudi Arabia
"DNSBOX is an excellent solution but what really convinced us was ApplianSys' attitude. Other appliance vendors were really inflexible..."
Mark Albutt, Technical Manager, Probrand Limited, UK
"DNSBOX enables us to automate the resolution of common queries and ensures a high reliability DNS service"
Mike Bird, IT Director, DHL, UK
"Our time spent administering DNS has dropped to virtually nothing. We can quickly set up domains or make changes to the master..."
Matt Niswonger, Techician at UltraTech Resources, USA

Protect Against Cache Poisoning with DNSSEC

DNSSEC protects against Man in the Middle and cache poisoning attacks, which can misdirect your users to malicious websites and/or disrupt your email and VOIP services. These attacks are designed to compromise private data, often with catastrophic consequences for enterprises:

  • Theft using stolen passwords/credentials for financial services
  • Damage to customer trust and your brand
  • Loss of valuable intellectual property
  • Fines from violation of regulatory compliance such as data protection

DNSSEC uses strong public key cryptography to sign DNS data which can then be validated by a requesting server. The root DNS zone and a growing number of Top Level Domains now sign their DNS records using DNSSEC, which creates a ‘chain of trust’ to validate answers down to an individual record. Many public DNS services, like Google DNS, can also now carry out this validation process and some governments have required their public sector agencies to implement DNSSEC – for example in the USA.

Service Providers have been slow to implement DNSSEC and many businesses would benefit from deploying it themselves. But implementing and managing DNSSEC can be complicated, costly and time-consuming:

  • All your zones need to be signed for DNSSEC to be effective – a big task for large networks
  • DNSSEC keys need to be stored securely so that they cannot be changed maliciously
  • Keys also need to be periodically updated – known as ‘key rollover’.
  • Additional DNSSEC steps in DNS resolution may introduce unwanted latency

Automate DNSSEC Key Rollover

Key rollover is particularly complex and requires very careful administration. If you get key rollover wrong, keys which are no longer valid remain cached in other DNS servers around the world or are not synchronised with your own upstream servers. In such cases, clients using DNSSEC would be unable to resolve your records.

To avoid this, you need to manage at least two sets of two types of key – a Zone Signing Key (ZSK) and a Key Signing Key (KSK), one of each live and one marked as in ‘rollover state’ – for each zone. The rollover keys need to exist for 2x their Time to Live value. With lots to know and manage, manual key rollover is incredibly error-prone.

You need a solution that, like DNSBOX:DNSSEC-Screenshot-sm

  • Automates DNSSEC key management and rollover
  • Automates zone signing for rapid implementation
  • Makes it easy to store DNSSEC keys securely
  • Uses a high performance resolver to mitigate the extra latency of DNSSEC requests

Next: Microsoft Integration >

Because DNSBOX is versatile and scalable, our customers around the world come in all shapes and sizes. ISPs, enterprises, government agencies and even internet registers simplify, control and protect their DDI services with DNSBOX.

How can we make your visit easier?


Give us a few details about your requirement and we'll make your life easier by serving the most relevant information.
I work in a...
I prefer to read...
GO