It is fairly easy to test if a DNS server is properly enforcing DNSSEC. According to OpenDNS “DNSSEC today represents a near-zero percentage of overall domain names and an increasingly smaller percentage of DNS records each day as the Internet grows”. Another major issue is that the deployment of DNSSEC remains very low since it takes the cooperation of both the DNS servers and domains themselves to implement it. This provides authentication of DNS responses but DNSSEC does not improve the privacy or confidentiality of the data since the responses are authenticated but they are not encrypted, so any third party capable of sniffing traffic can still see all queries and responses in plain text. All DNS record answers received from a DNSSEC protected zone are digitally signed and DNS resolver is able to check if the information in the answer is identical to the information published by the zone owner and served on an authoritative DNS server.

So what are options do we have to improve the security of DNS? The predominate answer is to use the DNS Security Extensions (DNSSEC). For more in depth details on the vulnerabilities of DNS see RFC3883. In addition to a malicious attackers, many ISPs also monitor and track their users internet usage using DNS and in many cases even hijack the DNS traffic to push advertisements. The plain text data allows the attacker to read queries and manipulate responses to redirect the user, without their knowledge, to any domain the attacker wishes. This makes a variety of attacks such as DNS spoofing, DNS hijacking and the use of a Rouge DNS server particularly easy. The main problems with DNS security and privacy lie in the fact that DNS queries and responses are transmitted in plain text and devices inherently trust and use the first response they receive. This service is crucial to security since the DNS response is trusted by applications as being correct and authentic. The DNS server then sends a DNS response back to your device with the IP. For example, when you type the domain name “” into a browser a DNS query is sent to recursive DNS server which then resolves that URL to the IP “172.217.11.46” or the IP of any Google search web server.

Every time we go to a website, or use any Internet connected service, DNS is working away in the background resolving domain names, those human readable addresses like, into the actual IP address of the resource. The Domain Name Service (DNS) is one of the core protocols that the Internet is built on.

Test opendns dnscrypt