DNSSEC Validation
Relevant source files
The following files were used as context for generating this wiki page:
DNSSEC (Domain Name System Security Extensions) validation is a critical security layer within the dns-hardening-parrot project designed to ensure the authenticity and integrity of DNS data. By validating digital signatures attached to DNS records, the system protects against DNS poisoning, spoofing, and man-in-the-middle attacks.
The implementation relies on the Unbound DNS resolver to perform local validation, ensuring that responses from upstream providers (like Cloudflare or Quad9) have not been tampered with. This configuration places the system's security posture in the top 1-2% globally by enforcing strict cryptographic checks on all DNS queries.
Sources: DNS_Hardening_Complete_Guide.md:7-15, README.md:12-18
Core Validation Architecture
The project utilizes a multi-layered approach to DNSSEC, where Unbound acts as the primary validator. The system is configured to refuse permissive modes, meaning it will explicitly fail to resolve domains that fail DNSSEC validation rather than falling back to unauthenticated data.
The diagram above illustrates how Unbound uses the root trust anchor to verify signatures during the resolution process.
Sources: configs/unbound.conf:28-32, UNBOUND_TLS_STATUS.md:21-25
Key Configuration Elements
The validation logic is defined within the server: block of the Unbound configuration. The following parameters ensure strict adherence to DNSSEC standards:
| Parameter | Value | Description |
|---|---|---|
auto-trust-anchor-file | /var/lib/unbound/root.key | Path to the root trust anchor for the DNSSEC chain of trust. |
val-clean-additional | yes | Removes untrusted data from the additional section of responses. |
val-permissive-mode | no | Prevents resolution if DNSSEC validation fails. |
harden-dnssec-stripped | yes | Protects against attacks that attempt to strip DNSSEC data from responses. |
harden-algo-downgrade | yes | Prevents attackers from forcing the use of weaker cryptographic algorithms. |
Sources: configs/unbound.conf:28-32, configs/unbound.conf:62-67
System-Level Integration
For DNSSEC to be effective, the operating system must be configured to trust the results provided by the local resolver. This project achieves this by modifying /etc/resolv.conf and systemd-resolved settings.
Resolver Configuration
The dns_harden.sh script generates a static /etc/resolv.conf file that includes the trust-ad option. This option informs system applications that they can trust the Authenticated Data (AD) flag returned by the local Unbound instance.
# Hardened DNS Configuration - DO NOT MODIFY
nameserver 127.0.0.1
...
options trust-ad
Sources: scripts/dns_harden.sh:37-46, README.md:118-124
Validation Monitoring and Alerts
The system includes automated monitoring via scripts/dns_alert.sh and scripts/dns_tls_monitor.sh to ensure the validation chain remains intact.
Verification and Testing
Validation success is primarily verified by checking for the ad (Authenticated Data) flag in DNS responses.
Verification Commands
Users can verify that DNSSEC is functioning correctly using the dig utility. A successful validation will return the ad flag in the header.
# Test DNSSEC validation
dig @127.0.0.1 +dnssec google.com | grep flags
# Expected output: flags: qr rd ra ad;
Sources: UNBOUND_TLS_STATUS.md:21-25, README.md:162-164
Troubleshooting Validation Failures
If validation fails, the project provides several diagnostic steps:
- Trust Anchor Check: Verify the existence of
/var/lib/unbound/root.key. - Config Validation: Run
unbound-checkconfto ensure syntax is correct. - Logs: Examine
journalctl -u unboundforval-log-level: 1output, which indicates validation errors.
Sources: configs/unbound.conf:32, DNS_Hardening_Complete_Guide.md:144-152
Summary
DNSSEC Validation in this project is implemented as a mandatory security gate. By utilizing Unbound's strict validation modes (val-permissive-mode: no) and system-level trust (options trust-ad), the infrastructure ensures that every resolved domain is cryptographically verified against the global root trust anchor, effectively eliminating common DNS-based redirection attacks.
Sources: configs/unbound.conf:31, scripts/dns_harden.sh:45