Nominet begins DNS Security Extensions roll out

DNSSec is a technical challenge for registrars and others

Nominet has taken the first steps towards boosting the security of its infrastructure by beginning the implementation of DNS Security Extensions (DNSSec) for the top level .uk domain.

The .uk registry said that it will introduce DNSSec information into five of the 11 UK name servers (ns1.nic.uk, nsa.nic.uk, nsb.nic.uk, nsc.nic.uk, nsd.nic.uk), and monitor the traffic to ensure optimal performance. The process should take around a week, said Nominet.

DNSSec allows for the creation of digital signatures to authenticate the traffic travelling between name servers, making it virtually impossible to spoof, according to Nominet IT director Simon McCalla.

DNS attacks came to prominence in 2008 when researcher Dan Kaminsky demonstrated that a flaw in the DNS could enable cache poisoning attacks on any name server, highlighting the threat to firms.

Once Nominet has signed the .uk domain it will move on to the more popular second level .co.uk domain, working with registrars, ISPs and other internet stakeholders to ensure that all the relevant name servers are upgraded.

McCalla explained that this is a technical challenge for registrars and others, but that tools such as the OpenDNSSec toolkit, which Nominet has helped to develop, could ease the burden.

"We are signing .uk this week which is a vital step. It is stating that we are starting the process of implementing it across all our domains and working with technical and policy groups to get buy-in," he said.

"It is a big technical effort and we need to make each registrar and ISP understand what it means to them. Tools like OpenDNSSec are great in creating awareness and saying: 'Yes, there is a technical challenge but here's how we can help.'"