One of my domain registrars has a very manual process to get the DS records set up in the parent zone. Think:
Write a support ticket
Get it bounced back with the "we don’t support DNSSEC“ reply by 1st-level support
Then restating the issue … and figure out what data they need and in what format
And days later getting it handled by the apparently single person who understands the issue and can solve the problem — if that person happens to be available.
I was thinking about sending them a request to please automate this by supporting RFC 7344 & RFC 8078.
However from rereading these RFCs I’m not sure the domain registrar is the correct recipient for this request?
Wouldn’t the parent domain registry be the more appropriate recipient for such a request?
(The problem there is that the domain registrant generally does not have a direct customer relationship with the parent domain registry. So they might not be inclined to even take note of such communication.)
Technically the parent domain registry could just use existing CDS/CDNSKEY records to update the DS records for the subdomain zones. The only issue might be the initial setup, as mentioned in RFC 8078 section 3, when the domain is not yet fully secured by DNSSEC.
The RFCs don’t prescribe whether the party to process CDS/CDNSKEY records is the registry or the registrar.
Some people say that the registrar should do it, because the registry is typically in the background, acting only upon the registrar’s request. Now, I think this is a circular argument (once you start doing it differently, the argument no longer holds).
In fact, most deployments in practice are by registries, and only very few registrars support it.
One complication of the registry doing the processing is that the registrar’s state might become outdated, unless the registry tells the registrar about the DS update. One way around this is for the registrar to not store the DNSSEC state itself. Another one is for the registry to send an EPP notification to the registrar, but the problem here is that these messages need to be proactively pulled by the registrar. (Nevertheless, this is how .se does it.)
If I were you, I would request automation from both the registry and the registrar. In the unlikely event that both will implement it, they can agree on a priority order between themselves.
That said, given the bad state of DNSSEC support at your registrar in general, it seems like you might want to consider moving your business to a registrar that is better at that. Let me know if you need suggestions.
The registrar in question was chosen primarily for their low prices for certain TLDs. So the fact that getting DNSSEC setup using external DNS at all is possible is already a bonus I will make the suggestion to automate this to them though as it may help to keep prices low if their support does not have to do this manually.
Sorry for digging out this old post, but it seems to describe my own situation just too well, so that I did not want to open a new thread.
2 years after this thread was opened, I am facing the exact same issue, except that I kept being unsuccessful when hassling my domain provider’s support to forward the DS and DNSKEY records to the registry. All they write is “Currently, it is not possible to use DNSSEC.”, which is not only unhelpful, but also just plain wrong according to my understanding. All they have to do is to forward these records to the registry so that they can set them up, don’t they?
I do want to change to a domain provider that is proactive about setting up DNSSEC. Do you have any suggestions?
It all depends on your needs. Many domain registrars offer ways to set the DS records in the parent zone, either with some web UI or via a support ticket. But some sadly don’t, as you seem to have found out. For the latter case the only solution would involve switching to a different registrar. Before switching, you may want to consult the FAQ or the support of the candidate registrar to find out whether they are able to set the DS records. (Both FAQs and the quality of their support answers are also good indications of their competence in my experience.)
The choice of registrars is huge. And it depends on the TLD, price constraints, and other criteria you may have. So making recommendations here is not really an option. If you have a candidate, you can ask if anyone has experience with them.
If you are using a more exotic TLD you may also want to check if it supports DNSSEC. There may still be some that don’t.
One can classify domain names into two categories: those with a “country-code top-level domain” (ccTLD) such as .io or .de (those have 2 letters), and those with a “generic top-level domain” (gTLD), such as .com or .berlin (those have more than 2 letters).
Registrar must allow its customers to use DNSSEC upon request by relaying orders to add, remove or change public key material (e.g., DNSKEY or DS resource records) on behalf of customers
Thus, if your domain is under a gTLD, then rejecting your request is a contract violation. In this case, please send your domain name to us via email, and we’ll try to take care of it by filing a complaint with ICANN.
The posts in DNSSEC Setup Guides - deSEC Community imply that those registrars support DNSSEC. If you want particular suggestions, please email us directly (we prefer not to advertise specific ones in public as that could be construed as advertising, which is incompatible with our legal status as a not-for-profit).
That’s correct for ccTLDs (as they are regulated only by the respective country). The gTLDs all are required to support DNSSEC, as they are subject to ICANN’s Registry Agreement which mandates that (see Section 6.1).
Stay secure,
Peter
PS: Our guidelines for DS automation have been approved by the IETF as a “Best Current Practice” (BCP). They are now in the RFC Editor queue, where the document likely will sit for a while. Once published, customers can attempt to direct registrars and registries to this BCP standard.
Thank you, @fiwswe and @peter, for your helpful responses!
@fiwswe, my particular use case is to use the domain for a static personal website and, most importantly, for emails. In particular for the latter case, setting up DNSSEC to guarantee the authenticity of my emails is important to me. Ideally I would like to be able to set the records in some web UI. My domain is a .net-domain.
@peter, what you write is very interesting. Many of these things I did not know. In particular it is great to hear that in my case (using a .net gTLD) the registrar is oblidged to allow me to use DNSSEC. Maybe I will not need to change the domain provider after all then. I will email you my domain details now. Thank you very much!
I will make the suggestion to automate this to them though as it may help to keep prices low if their support does not have to do this manually.