jakobod/dnssec-validation

Some python scripts for verifying the chain of trust for a given domain

Hi there! 👋🏻

I am a Software Engineer working in the field of communication and distributed systems, with a particular interest in high performance computing and framework development.

dnssec-validation's Issues

More concise ouput

There should be more information that is written to the csv for the evaluation. For example:

• Where has the chain been broken?
• Why did the chain break
• and so on...

validate zone function can fail

There are simply not enough checks within the validate_zone function. In some cases the results of function calls can be None, which will let other calls fail.

Retry Queries

Some queries time out or fail for some reason. Such queries should be retried as long as the error was not NXDOMAIN or equal.

Continue the chain despite validation errors

It would be interesting if the chain of trust is broken in a single place but continues after that.
Hence, the validation should follow through even if the chain could not be validated completely!

Add caches

To speed up the process and limit the number of necessary queries, all validated and known invalid domains and such should be cached.

1. known to NOT be DNSSEC secured -> NSEC or NSEC3.

Track DNSKEY algorithms

There are a lot of feasible algorithms for DNSKEYs. Some of these are deprecated and insecure (i.e. SHA1). During the checking phase the Algorithm should be saved and written to the json.