SIDN has developed an application that lets you check whether you are ready to validate DNSSEC signatures. In a few seconds, you can find out whether the DNS resolver that your computer uses supports the DNSSEC protocol.
In 2010, SIDN signed the .nl zone using DNSSEC, paving the way for this year’s second phase of DNSSEC implementation. That phase involves SIDN making it possible to include the trust anchors for signed .nl domain names in the .nl zone. Inclusion of the anchors is an important step, because it completes the chain of trust linking the root zone, the .nl zone and individual domain names. The chain of trust is vital for DNSSEC to work properly. Another important feature of phase 2 is encouraging internet service providers (ISPs) and internet users to work with DNSSEC. That implies ISPs offering domain name signing services and setting up their DNS resolvers to support DNSSEC. It also means that any firmware installed on the modems and routers that people use to connect to the net have to be DNSSEC-enabled. All these steps have to be taken before the whole chain can benefit from the added security offered by DNSSEC.
DNSSEC Test
The DNSSEC test that SIDN has developed makes it easy to find out whether your set-up is making active use of DNSSEC. If the test result is a green tick, you know you are DNSSEC ready – in other words, that your ISP’s DNS resolver and your modem or router’s firmware support DNSSEC. If you get a red cross, DNSSEC is not yet supported and you aren’t currently benefiting from DNSSEC’s added security.