Maintenance, mishaps and mending in deployments of the domain name system security extensions (DNSSEC)

The Domain Name System Security Extensions (DNSSEC) add an element of authentication to the DNS, which is a foundational component of the Internet. However, the maintenance of a DNSSEC deployment is more complex than that of its insecure counterpart. This paper discusses some specific misconfigurations that impact DNSSEC deployments, analyzes their prevalence via an extended survey of production DNS zones implementing DNSSEC, and assesses the maintenance and corrective actions. Our survey indicated that more than one-half of the zones analyzed were affected by misconfigurations. Also, the survey revealed a significant number of repeat occurrences and average correction times of up to two weeks. This paper summarizes the survey findings and suggests approaches for improving the quality of DNSSEC deployments.