I’ve received on my postmaster@ address a message from some security researchers warning me of the “insecure” #DNSSEC configuration of my domain, so for the record:

My domain (incenp.org) is configured to use #NSEC, and not #NSEC3, on purpose. This is not a misconfiguration. I weighed the pros and cons of NSEC3, and decided it was just not worth it.

Yes, people could use NSEC records to enumerate all the DNS records of my zone. So what?

Usually I am not a fan (and that’s an euphemism) of the “if you have nothing to hide, you have nothing to fear” argument, but in this case, there is really nothing to hide in my DNS zone. I would happily give a list of all the records (or even the original master zone file) to anyone who asks for it.

Actually last time I checked, one of the slave DNS servers I use was even configured to allow #AXFR requests from anywhere, and I never bothered to contact the admin of that server to ask him to do anything about it. So if you want the entirety of my zone’s records, don’t waste your time mounting a NSEC enumeration attack, just ask the right server.

Sometimes my primary name-server has problems sending notify to the secondaries. This little script helped me by doing it manually.

https://github.com/hirose31/send-dns-notify/blob/master/send-dns-notify

#DNS #AXFR

In case you ever need to test an #AXFR implementation or just want to play around with zone transfers:

I created a thing for such use cases: https://icanhazaxfr.com