In a huge step forward for Internet security today, Google announced that Google’s “Public DNS” service is now performing DNSSEC validation. What this means is that anyone using Google’s DNS servers (and anyone can do so – see below) can now get the increased security that comes with DNSSEC. (Learn more about the value of DNSSEC on our DNSSEC Basics page.)
It also means that if you want the added security of DNSSEC, but your Internet Service Provider and local operating system don’t validate with DNSSEC, you can simply change your operating system to point to the following DNS servers operated by Google for either (or both) IPv4 and IPv6:
8.8.8.8
8.8.4.4
2001:4860:4860::8888
2001:4860:4860::8844
Once configured, all future DNS queries will be resolved using these DNS servers and DNSSEC validation will be performed by Google’s servers. You will then benefit from the added protection of DNSSEC validation. (Our resource page about Google Public DNS offers a few more pointers about configuration.)
Note that there is one important caveat here - you have to request DNSSEC validation when you send the DNS query to Google’s Public DNS servers, i.e. they will only validate the DNS query if you request it. To do that you need an application that supports DNSSEC. For web browsers, there are add-ons and extensions for both Google Chrome and Mozilla Firefox:
If you are an application developer, there are DNS developer libraries that support DNSSEC available in a wide range of programming languages so that you can add DNSSEC support to your application.
In the announcement, Google’s Yunhong Gu noted that Google Public DNS is currently “serving more than 130 billion DNS queries on average (peaking at 150 billion) from more than 70 million unique IP addresses each day.” As the article further notes:
“Effective deployment of DNSSEC requires action from both DNS resolvers and authoritative name servers. Resolvers, especially those of ISPs and other public resolvers, need to start validating DNS responses. Meanwhile, domain owners have to sign their domains. Today, about 1/3 of top-level domains have been signed, but most second-level domains remain unsigned. We encourage all involved parties to push DNSSEC deployment and further protect Internet users from DNS-based network intrusions.”
To that end, if you have domains registered, we strongly encourage you to learn about how your can sign your domains with DNSSEC using domain name registrars. You can learn more about which top-level domains support DNSSEC on our DNSSEC Statistics page.
Google provides the following information about using their Public DNS service:
This move by Google to provide this DNSSEC validation is a great addition to the support for DNSSEC validation offered by large US ISPs such as Comcast (making DNSSEC validation available to their 18 million customers) as well as ISPs in a wide range of countries including Sweden, the Czech Republic and Brazil.
We look forward to seeing more public DNS providers and more ISPs turn on DNSSEC validation in their networks. If you want to know more about what is involved with enabling DNSSEC validation on your network, including home and enterprise networks, this SURFnet white paper provides easy instructions for common DNS servers.
And in the meantime, if you don’t want to wait for your ISP and want to start getting the value in DNSSEC validation today, you now have the option of using Google’s public DNS servers!
