Enable DNSSEC with OpenDNS

[cowboy]

I got interested in DNSSEC and want to enable it on my Asus AC88U router running Asuswrt-Merlin 384.15. But as I understand the DNS hosting provider has also to support it.

I am using OpenDNS server and few days ago they announced that they will start supporting DNSSEC in this blog post: DNSSEC General Availability

When I enable the "Validate unsigned DNSSEC replies" in the WAN DNS Settings, I can't reach any website anymore. So does DNSSEC work with OpenDNS or am I understanding something wrong from OpenDNS blog post ?

And how can I verify that I am using DNSSEC ?

 

[L&LD]

Does a reboot help?

 

[cowboy]

Does a reboot help?

I enabled it yesterday, but did not reboot. I will try that tomorrow in the morning.

Is anyone here who uses DNSSEC on Asuswrt-Merlin with OpenDNS and can confirm that everything works ?

 

[krgck]

Tried it. Sandbox and familyshield does work "Validate unsigned DNSSEC replies" enabled but production doesn't. Likely issue on their end.

 

[cowboy]

Tried it. Sandbox and familyshield does work "Validate unsigned DNSSEC replies" enabled but production doesn't. Likely issue on their end.

Thanks. Ok then maybe we have to wait a few days more.


I tried it also out and restarted my devices. But it did not solve the problem.

 

[cowboy]

I asked the question on OpenDNS forum. Apparently I don't need to enable any settings on my router for DNSSEC to work. But I thought that for DNSSEC to work BOTH the server and client side have to enable it.

Here is the OpenDNS forum: DNSSEC does not work on Production Resolvers

 

[krgck]

I asked the question on OpenDNS forum. Apparently I don't need to enable any settings on my router for DNSSEC to work. But I thought that for DNSSEC to work BOTH the server and client side have to enable it.

Here is the OpenDNS forum: DNSSEC does not work on Production Resolvers

Well that might be true, but why "familyshield" and "sandbox" does pass dnssec test and production does not?
https://dnssec.vs.uni-due.de/

 

[BatJoe]

It does say the target for production was the 24th, but maybe since it said target they haven't reached it yet and there is a delay? I've opened a support ticket on this.

 

[cowboy]

It does say the target for production was the 24th, but maybe since it said target they haven't reached it yet and there is a delay? I've opened a support ticket on this.

Update us if you have any news.

 

[BatJoe]

They literally deleted my support ticket asking about DNSSEC......

 

[cowboy]

They literally deleted my support ticket asking about DNSSEC......

Wow just like that.

 

[BatJoe]

So I guess just use FamilyShield IPs if you want DNSSEC. But you will miss your porn sites lol

 

[cowboy]

So I guess just use FamilyShield IPs if you want DNSSEC. But you will miss your porn sites lol

Maybe in few weeks trying again the option might work

 

[BatJoe]

OpenDNS production IPs now validate with DNSSEC

 

[dave14305]

Interesting that they prefer customers not enable dnssec validation. I wonder what happens if they are blocking (rewriting) a name in a signed zone?

Support for client-side validation
Performing DNSSEC validation requires that the validating resolver maintain knowledge of the signatures of all parent domains for a given query. For this reason, clients of a recursive DNS resolver typically do not perform validation themselves, but rather rely on the recursive resolver to perform validation on their behalf.

While we will support use of the ‘DO’ bit in queries, Umbrella does not recommend that local DNS servers forwarding to our resolvers enable DNSSEC validation themselves.

See https://learn-umbrella.cisco.com/feature-briefs/support-for-dnssec-in-umbrella

 

[SomeWhereOverTheRainBow]

Interesting that they prefer customers not enable dnssec validation. I wonder what happens if they are blocking (rewriting) a name in a signed zone?

See https://learn-umbrella.cisco.com/feature-briefs/support-for-dnssec-in-umbrella

Yea I have been a skeptic about the DNSSEC support every since @Zastoff informed me of the changes with OpenDNS. OpenDNS is trying to play catch up since now they have DoH servers, from my understanding their dnscrypt protocol standards are still behind though in regards to current status of dnscrypt is concerned.

Here is more about ciscos DoH
https://support.opendns.com/hc/en-us/articles/360038086532-Using-DNS-over-HTTPS-DoH-with-OpenDNS

and more about the servers

[static.'cisco-doh-ipv4-pri']
stamp = 'sdns://AgAAAAAAAAAADjIwOC42Ny4yMjIuMjIygAATZG9oLm9wZW5kbnMuY29tOjQ0MwovZG5zLXF1ZXJ5'

[static.'cisco-doh-ipv4-alt']
stamp = 'sdns://AgAAAAAAAAAADjIwOC42Ny4yMjAuMjIwgAATZG9oLm9wZW5kbnMuY29tOjQ0MwovZG5zLXF1ZXJ5'

[static.'cisco-doh-ipv6-pri']
stamp = 'sdns://AgAAAAAAAAAAEVsyNjIwOjExOTozNTo6MzVdgAATZG9oLm9wZW5kbnMuY29tOjQ0MwovZG5zLXF1ZXJ5'

[static.'cisco-doh-ipv6-alt']
stamp = 'sdns://AgAAAAAAAAAAEVsyNjIwOjExOTo1Mzo6NTNdgAATZG9oLm9wZW5kbnMuY29tOjQ0MwovZG5zLXF1ZXJ5'

[static.'cisco-doh-ipv4-family-pri']
stamp = 'sdns://AgAAAAAAAAAADjIwOC42Ny4yMjIuMTIzgAAgZG9oLmZhbWlseXNoaWVsZC5vcGVuZG5zLmNvbTo0NDMKL2Rucy1xdWVyeQ'

[static.'cisco-doh-ipv4-family-alt']
stamp = 'sdns://AgAAAAAAAAAADjIwOC42Ny4yMjAuMTIzgAAgZG9oLmZhbWlseXNoaWVsZC5vcGVuZG5zLmNvbTo0NDMKL2Rucy1xdWVyeQ'

[static.'cisco-doh-ipv6-family-pri']
stamp = 'sdns://AgAAAAAAAAAAElsyNjIwOjExOTozNTo6MTIzXYAAIGRvaC5mYW1pbHlzaGllbGQub3BlbmRucy5jb206NDQzCi9kbnMtcXVlcnk'

[static.'cisco-doh-ipv6-family-alt']
stamp = 'sdns://AgAAAAAAAAAAElsyNjIwOjExOTo1Mzo6MTIzXYAAIGRvaC5mYW1pbHlzaGllbGQub3BlbmRucy5jb206NDQzCi9kbnMtcXVlcnk'

which were provided by @DonnyJohnny in this post https://www.snbforums.com/threads/release-dnscrypt-installer-for-asuswrt.36071/page-75#post-553892

 

[cowboy]

OpenDNS production IPs now validate with DNSSEC

For me enabling the setting "Validate unsigned DNSSEC replies" still does not work

 

[BatJoe]

For me enabling the setting "Validate unsigned DNSSEC replies" still does not work

They must be having issues. It was working.

EDIT: They have updated their support page to state production IPs will have it March 10.

 

[cowboy]

I turned it on and now DNSSEC works with OpenDNS as expected.