[AC3200] Should I enable DNSSEC?

[AntonK]

Hi,

I just switched from OpenDNS to Quad9 DNS. While I didn't with OpenDNS, should I enable DNSSEC with Quad9? Quad9's FAQ says,

Yes. Quad9 provides DNSSEC validation on all of our resolvers. This means that for domains that implement DNSSEC security, the Quad9 system will cryptographically ensure that the response provided matches the intended response of the domain operator. In the event of a cryptographic failure, our system will not return an answer at all. This ensures protection against domain spoofing or other attacks that attempt to provide false data. Learn more about DNSSEC here: https://www.icann.org/resources/pages/dnssec-qaa-2014-01-29-en Note that some variations of our resolver (different IP addresses) may not provide DNSSEC.​

Since I don't really know what all this means, any suggestions? I'm using RMerlin's 384.6.

Thanks,
Anton

 

[Treadler]

Hi,

I just switched from OpenDNS to Quad9 DNS. While I didn't with OpenDNS, should I enable DNSSEC with Quad9? Quad9's FAQ says,

Yes. Quad9 provides DNSSEC validation on all of our resolvers. This means that for domains that implement DNSSEC security, the Quad9 system will cryptographically ensure that the response provided matches the intended response of the domain operator. In the event of a cryptographic failure, our system will not return an answer at all. This ensures protection against domain spoofing or other attacks that attempt to provide false data. Learn more about DNSSEC here: https://www.icann.org/resources/pages/dnssec-qaa-2014-01-29-en Note that some variations of our resolver (different IP addresses) may not provide DNSSEC.​

Since I don't really know what all this means, any suggestions? I'm using RMerlin's 384.6.

Thanks,
Anton

My 10 cents worth.......

Yes, you should.
But with a proviso, Merlin has put considerable work into DNSSEC recently. In my opinion you should update your firmware to 384.7 to take advantage of this, (currently in beta3 & running just fine), as part of your strategy.

 

[AntonK]

Thanks Treadler! There is no 384.7 for the AC-3200, but I will enable it and see how it goes. The first thing I noticed was that I had to use the IP address to login to my router from my wired Desktop. The URL "router.asus.com/Main_Login.asp" would not work.

 

[skeal]

I agree with the above strategy. 384.7 will get your DNSSEC working properly. Not yet released for your model.

 

[AntonK]

I agree with the above strategy. 384.7 will get your DNSSEC working properly. Not yet released for your model.

There is no 384.7 for the AC-3200.

 

[skeal]

There is no 384.7 for the AC-3200.

Re-read my statement...

 

[AntonK]

Re-read my statement...

Oops, sorry about that! Those are well deserved rolleyes for me!

Thanks Skeal,
Anton

 

[bitmonster]

Does Cloudflare (1.1.1.1) DNS support DNSSec..
384.7 is a beta firmware although it appears to be already well regarded. Perhaps I should try it.

 

[Treadler]

Does Cloudflare (1.1.1.1) DNS support DNSSec..
384.7 is a beta firmware although it appears to be already well regarded. Perhaps I should try it.

Yes, Cloudflare does DNSSEC.

 

[Treadler]

There is no 384.7 for the AC-3200.

Oooops, I should have checked! ;-)

 

[OMNI619]

Yes it will support DNSSEC as well quad9

Sent from my SAMSUNG-SM-G920AZ using Tapatalk