DNSSEC Validating Resolver

[stephbu]

Overview

Implement DNSSEC chain validation for responses received from upstream resolvers. This is Phase 1C of DNSSEC support — the core validation logic that verifies cryptographic signatures.

Parent Issue

• DNS-Sec support #2 — DNSSEC Support (Phase 1C)

Prerequisites

• EDNS(0) support (to request DNSSEC records via DO bit)
• DNSSEC record parsing (RRSIG, DNSKEY, DS, NSEC)

Background

A validating resolver performs cryptographic verification of DNS responses:

1. Trust Anchor: Starts with a configured root KSK (Key Signing Key)
2. Chain of Trust: Validates DS → DNSKEY links from root through TLD to target domain
3. Signature Verification: Verifies RRSIG signatures against DNSKEY records
4. Denial of Existence: Validates NSEC/NSEC3 for NXDOMAIN responses

Implementation Tasks

Trust Anchor Management

• Create TrustAnchorStore class
• Load root KSK from configuration or embedded resource
• Support for multiple trust anchors (root + any configured DLV)
• Automatic trust anchor updates (RFC 5011) — future enhancement
• Configuration in appsettings.json:

  "Dnssec": {
    "ValidationMode": "Strict",  // Strict | Permissive | Disabled
    "TrustAnchors": [
      {
        "Zone": ".",
        "KeyTag": 20326,
        "Algorithm": 8,
        "DigestType": 2,
        "Digest": "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D"
      }
    ]
  }

DNSKEY Validation

• Create DnssecValidator class
• Verify DNSKEY RRset is signed by a key matching trust anchor DS
• Verify DNSKEY self-signatures (ZSK signed by KSK)
• Cache validated DNSKEY records per zone

RRSIG Signature Verification

• Implement signature verification for each algorithm:
  • RSA/SHA-256 (Algorithm 8) — priority
  • RSA/SHA-512 (Algorithm 10)
  • ECDSA P-256/SHA-256 (Algorithm 13)
  • ECDSA P-384/SHA-384 (Algorithm 14)
  • Ed25519 (Algorithm 15) — if .NET crypto supports
• Construct canonical RRset for signing (RFC 4034 §6.3)
• Verify signature expiration/inception times
• Verify label count matches

Chain Building

• Implement BuildValidationChain(domainName):
  • Query for DNSKEY at each level (root → TLD → domain)
  • Verify DS at parent matches DNSKEY at child
  • Cache intermediate results
• Handle insecure delegations (no DS record)
• Handle algorithm downgrade attacks

Authenticated Denial

• Validate NSEC records prove name doesn't exist
• Validate NSEC records prove record type doesn't exist
• Implement NSEC3 validation (hashed names)
• Handle opt-out zones

Response Processing

• Integrate validation into DnsServer.ProcessUdpRequest()
• Set AD (Authenticated Data) flag on validated responses
• Honor CD (Checking Disabled) flag from clients
• Return SERVFAIL for validation failures (in Strict mode)
• Log validation failures with details

Validation Policies

• Strict: Fail if validation fails, require DNSSEC for signed zones
• Permissive: Validate when possible, pass through on failure
• Disabled: Skip all validation (for debugging)

Testing

Unit Tests

• Trust anchor loading and matching
• DNSKEY validation against DS
• RRSIG signature verification (per algorithm)
• Canonical RRset construction
• NSEC/NSEC3 denial validation

Integration Tests

• Query known DNSSEC-signed domain, verify AD flag set
• Query with CD flag, verify no validation performed
• Test with intentionally broken signatures (should fail)
• Test unsigned domain, verify no AD flag
• Test NXDOMAIN with NSEC proof

Test Domains

# Well-known DNSSEC-signed domains for testing
dig +dnssec dnssec-failed.org    # Intentionally broken
dig +dnssec cloudflare.com       # ECDSA
dig +dnssec google.com           # RSA
dig +dnssec isc.org              # Well-maintained DNSSEC

Technical References

• RFC 4033 — DNS Security Introduction
• RFC 4035 — Protocol Modifications for DNSSEC
• RFC 5155 — NSEC3
• RFC 6840 — DNSSEC Clarifications and Updates

Acceptance Criteria

• Validation chain builds from root to target domain
• RRSIG signatures verified (at least RSA-SHA256, ECDSA)
• AD flag correctly set on validated responses
• CD flag honored when client disables checking
• SERVFAIL returned for validation failures (Strict mode)
• NSEC/NSEC3 denial proofs validated
• Configurable validation policy
• Performance acceptable (caching, parallel queries)
• Comprehensive test coverage

Related Issues

• DNS-Sec support #2 — DNSSEC Support (parent)
• EDNS(0) issue (prerequisite)
• DNSSEC Record Parsing issue (prerequisite)