BIND DNS
TMA-BIND-8.8
Ensure Zones are Signed with NSEC or NSEC3
Description
The NSEC records are used to prove that a name does not exist, by providing the name before it, and the name after it. NSEC3 records are similar, while using a hash to link records in order to make zone enumeration much more difficult. Either record type will securely validate a negative answer that a name does not exist. Manual review: the check needs remote queries, architecture knowledge or site policy.
How it is checked
Audit method: Manual review
To audit the authoritative name server, use the delv command on a independent DNSSEC validating resolver to query a nonexistent name of the authoritative name server. The response should be a "negative response, fully validated" similar to the following example. $ delv @8.8.8.8 nosuch-name.isc.org; resolution failed: ncache nxdomain ; negative response, fully validated ; nosuch-name.isc.org. 3200171710 IN \-ANY ;-$NXDOMAIN ; isc.org. SOA ns-int.isc.org. hostmaster.isc.org. 2020031004 7200 3600 24796800 . . . A non-compliant response will not contain the "fully validated" response.
How it is fixed
Fix method: Guidance or infrastructure patch
An NSEC record and NSEC signatures are generated automatically by BIND for DNSSEC signed zones. If the audit fails, then verify that the zone has a valid signature and has delegated trust from the parent domain as in the previous recommendations "8.5 Ensure each Zone has a Valid Digital Signature" and "8.6 Ensure Full Digital Chain of Trust can be Validated" The signed zone file, or a zone transfer can also be checked for NSEC signatures. With a command such as: $ dig @127.0.0.1 example.org AXFR | grep -w 'NSEC' example.org. 86400 IN NSEC www.example.org. A NS SOA RRSIG NSEC DNSKEY TYPE65534 example.org. 86400 IN RRSIG NSEC 8 2 86400 20200325222408 20200224212408 4236 . . .
Properties
- Operating systems
- Any
- Tags
- binddnsdnssec
- Reference
- CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 8.8 Ensure Zones are Signed with NSEC or NSEC3