1.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") 2.. 3.. SPDX-License-Identifier: MPL-2.0 4.. 5.. This Source Code Form is subject to the terms of the Mozilla Public 6.. License, v. 2.0. If a copy of the MPL was not distributed with this 7.. file, you can obtain one at https://mozilla.org/MPL/2.0/. 8.. 9.. See the COPYRIGHT file distributed with this work for additional 10.. information regarding copyright ownership. 11 12.. _getting_started: 13 14Getting Started 15--------------- 16 17.. _software_requirements: 18 19Software Requirements 20~~~~~~~~~~~~~~~~~~~~~ 21 22This guide assumes BIND 9.18.0 or newer, although the more elaborate manual 23procedures do work with all versions of BIND later than 9.9. 24 25We recommend running the latest stable version to get the most 26complete DNSSEC configuration, as well as the latest security fixes. 27 28.. _hardware_requirements: 29 30Hardware Requirements 31~~~~~~~~~~~~~~~~~~~~~ 32 33.. _recursive_server_hardware: 34 35Recursive Server Hardware 36^^^^^^^^^^^^^^^^^^^^^^^^^ 37 38Enabling DNSSEC validation on a recursive server makes it a *validating 39resolver*. The job of a validating resolver is to fetch additional 40information that can be used to computationally verify the answer set. 41Contrary to popular belief, the increase in resource consumption is very modest: 42 431. *CPU*: a validating resolver executes cryptographic functions on cache-miss 44 answers, which leads to increased CPU usage. Thanks to standard DNS caching 45 and contemporary CPUs, the increase in CPU-time consumption in a steady 46 state is negligible - typically on the order of 5%. For a brief period (a few 47 minutes) after the resolver starts, the increase might be as much as 20%, but it 48 quickly decreases as the DNS cache fills in. 49 502. *System memory*: DNSSEC leads to larger answer sets and occupies 51 more memory space. With typical ISP traffic and the state of the Internet as 52 of mid-2022, memory consumption for the cache increases by roughly 20%. 53 543. *Network interfaces*: although DNSSEC does increase the amount of DNS 55 traffic overall, in practice this increase is often within measurement 56 error. 57 58.. _authoritative_server_hardware: 59 60Authoritative Server Hardware 61^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 62 63On the authoritative server side, DNSSEC is enabled on a zone-by-zone 64basis. When a zone is DNSSEC-enabled, it is also known as "signed." 65Below are the expected changes to resource consumption caused by serving 66DNSSEC-signed zones: 67 681. *CPU*: a DNSSEC-signed zone requires periodic re-signing, which is a 69 cryptographic function that is CPU-intensive. If your DNS zone is 70 dynamic or changes frequently, that also adds to higher CPU loads. 71 722. *System storage*: A signed zone is definitely larger than an unsigned 73 zone. How much larger? See 74 :ref:`your_zone_before_and_after_dnssec` for a comparison 75 example. The final size depends on the structure of the zone, the signing algorithm, 76 the number of keys, the choice of NSEC or NSEC3, the ratio of signed delegations, the zone file 77 format, etc. Usually, the size of a signed zone ranges from a negligible 78 increase to as much as three times the size of the unsigned zone. 79 803. *System memory*: Larger DNS zone files take up not only more storage 81 space on the file system, but also more space when they are loaded 82 into system memory. The final memory consumption also depends on all the 83 variables listed above: in the typical case the increase is around half of 84 the unsigned zone memory consumption, but it can be as high as three times 85 for some corner cases. 86 874. *Network interfaces*: While your authoritative name servers will 88 begin sending back larger responses, it is unlikely that you need to 89 upgrade your network interface card (NIC) on the name server unless 90 you have some truly outdated hardware. 91 92One factor to consider, but over which you really have no control, is 93the number of users who query your domain name who themselves have DNSSEC 94enabled. As of mid-2022, measurements by `APNIC 95<https://stats.labs.apnic.net/dnssec>`__ show 41% of Internet users send 96DNSSEC-aware queries. This means that more DNS queries for your domain will 97take advantage of the additional security features, which will result in 98increased system load and possibly network traffic. 99 100.. _network_requirements: 101 102Network Requirements 103~~~~~~~~~~~~~~~~~~~~ 104 105From a network perspective, DNS and DNSSEC packets are very similar; 106DNSSEC packets are just bigger, which means DNS is more likely to use 107TCP. You should test for the following two items to make sure your 108network is ready for DNSSEC: 109 1101. *DNS over TCP*: Verify network connectivity over TCP port 53, which 111 may mean updating firewall policies or Access Control Lists (ACL) on 112 routers. See :ref:`dns_uses_tcp` for more details. 113 1142. *Large UDP packets*: Some network equipment, such as firewalls, may 115 make assumptions about the size of DNS UDP packets and incorrectly 116 reject DNS traffic that appears "too big." Verify that the 117 responses your name server generates are being seen by the rest of the 118 world: see :ref:`whats_edns0_all_about` for more details. 119 120.. _operational_requirements: 121 122Operational Requirements 123~~~~~~~~~~~~~~~~~~~~~~~~ 124 125.. _parent_zone: 126 127Parent Zone 128^^^^^^^^^^^ 129 130Before starting your DNSSEC deployment, check with your parent zone 131administrators to make sure they support DNSSEC. This may or may not be 132the same entity as your registrar. As you will see later in 133:ref:`working_with_parent_zone`, a crucial step in DNSSEC deployment 134is establishing the parent-child trust relationship. If your parent zone 135does not yet support DNSSEC, contact that administrator to voice your concerns. 136 137.. _security_requirements: 138 139Security Requirements 140^^^^^^^^^^^^^^^^^^^^^ 141 142Some organizations may be subject to stricter security requirements than 143others. Check to see if your organization requires stronger 144cryptographic keys be generated and stored, and how often keys need to be 145rotated. The examples presented in this document are not intended for 146high-value zones. We cover some of these security considerations in 147:ref:`dnssec_advanced_discussions`. 148