Towards detecting DNSSEC validation
failure with passive measurements
at TLD DNS servers
Kensuke Fukuda (NII)
Yoshiro Yoneya (JPRS)
Takeshi Mitamura (JPRS)IEPG @ Singapore
Nov 17, 20191

Introduction• DNSSEC validation failure
happens frequently• Reliability of operation is a keyof deployment

2Research question• How to detect validation failure rapidly and efficiently?
• Active measurement• Periodic querying to authoritative servers• Higher loads for more DNSSEC available domains• Passive measurement• Change of query patterns could be a good indicator?

3

Towards detecting validation failures with
passive measurements• Goal:• Detecting change of query patterns at ccTLD servers
before and after failure• Current our work: Analysis with active measurements• DNS clients:• RIPE Atlas probe• DNSSEC validators (approx. 500) at ISPs or edges (not publicDNS)• Local authoritative DNS server (3LD):• Successful and failed validator settings• Different TTL settings• Vantage point:• JP-DNS (ccTLD of JP)
4

Measurement overview

Passive measurement• Measurement period• Apr 2018 (50hrs)• Vantage point:• ccTLD (JP)• Local authoritative:• 3LD (e.g. a.dns-ok13.dnslab.jp)• Target queries• NS, A, DNSKEY, DS• RIPE atlas probes• 600 DNSSEC validators at home
Active measurement

5How to find non-public DNSSEC validators• Matching RIPE atlas probe logs to localauth logs

• Atlas probe with home and stable-1day tags
• Send unique A query (prepended timestampand probe ID) with DO• Check query’s src IP at local auth

• E.g., ignore probes if corresponding src IPs belong togoogle• Check reply’s AD flag
• Use 602 probes and 985 resolvers

6

TTL parameters in JP DNSSEC domains• NS and TTL settings• NS short and DNSKEY short• Media sites• NS long and DNSKEY long
• ISP, registry• NS middle and DNSKEY middle• ISPs• NS short and DNSKEY long• government

No clear recommendations on each setting
7

Parameter settings• Valid: successful validator (y) and failed validator (n)• Interval: query interval from each probe• Duration: measurement period for each probe8

Parameter settings

DS and A are fixedInterval and duration are also fixed

Successfulvalidators

Failedvalidators• Valid: successful validator (y) and failed validator (n)• Interval: query interval from each probe• Duration: measurement period for each probe9

Results: Queries at local authoritative

Successful

Failed• Overall queries increased in failure (as expected)• Due to negative cache• All 5x, A 2x, DKEY 7x, DS 3x, NS 6x• TTL settings for NS and DNSKEY worked in successful validator
10Queries at ccTLD (JP-DNS)

SuccessfulFailed• Still queries increased, but not so significant• DNSKEY is a better indicator than DS• Longer DNSKEY TTL is better (due to negative cache?)11

Queries at ccTLD (JP-DNS)

SuccessfulFailed• Still queries increased, but not so significant• DNSKEY is a better indicator than DS• Longer DNSKEY TTL is better (due to negative cache?)
12

Attenuation at ccTLD

Local authoritative

ccTLD (JP-DNS)• Huge attenuation of observable queries• All 30x, A 7x, DNSKEY 300x, DS 200x

• A validation failure in minor domains is likely difficult to detect
13

Conclusion• We conducted DNS passive and active measurement to know
query behaviors in DNSSEC failure• Active: RIPE Atlas probes• Passive: ccTLD (jp) and local authoritative• DNS queries increased at DNSSEC validation failure• Attenuation of queries in DNS hierarchy• DNSKEY difference is still a good metric to detect validation failure• DS is not so significant

14

Future work
• Further large-scale studies required• Difference in public and other resolvers• Quantify ccTLD, 2LD, and 3LD attenuation• TTL effects in failure• Longitudinal analysis of a part of JP-DNS servers’ traces• Effective (quasi-)realtime detection method at TLD servers’ side15