CircleID

Nominum, the leader in intelligent DNS solutions, today announced new capabilities that eliminate barriers to DNSSEC deployment. Nominum's latest software release completely integrates functions needed to successfully deploy DNSSEC at any scale without costly proprietary appliances. In addition, automation of DNSSEC processes eliminates operational overhead and errors that could cause Internet sites to disappear. Coupled with unique layered defenses, Nominum now has the strongest possible protections for Internet users relying on both signed and unsigned DNS data. These new features are available in Nominum's industry leading DNS servers (ANS, ANSP, and Vantio), or with SKYE™, its highly secure and reliable hosted service offering for service provider and enterprise customers worldwide.

"One of the grand challenges the Internet faces is: How do we make security scale? With over 61 percent of compromises being traced to authentication flaws, we clearly have a big problem. DNSSEC is the big solution that we need to fix authentication," said Dan Kaminsky, the security researcher who identified a key flaw in DNS security in 2008. "And there is progress. I have been proud to see, in the wake of my DNS vulnerability finding, a steady drumbeat towards signatures at the Root and TLD layers. But large organizations need it to be easier and less disruptive to deploy DNSSEC before they can reasonably be expected to secure their own domain names. That is why I am happy to see Nominum adding comprehensive DNSSEC support to their DNS server platforms — and even happier to see DNSSEC almost entirely automated within it. DNSSEC can, should, and must "just work", and Nominum has done an excellent job making that so."

Simplifying DNSSEC Deployment for Brand Owners and Service Providers

Today, brand owners have well understood procedures to publish and update DNS data that convey their brands (mail@nominum.com, www.nominum.com). Introducing DNSSEC adds many new complex functions that must be implemented flawlessly or Internet sites may disappear. Nominum has integrated and automated these critical functions into its existing DNS servers. Now, DNSSEC processes that previously required additional equipment such as external "signing" appliances are included in Nominum software running on commodity server hardware. Complex multi-step manual operations that required expert intervention and frequent repetition can now be executed once, with a few keystrokes by existing staff. Eliminating intensive and repetitive manual effort removes the need for specialized expertise, prevents errors that result in service outages and reduces costs.

"Since the Kaminsky vulnerability, a lot of progress has been made in DNSSEC deployment with various top level domains signed or committed to be signed. The next battleground in DNSSEC adoption will be in getting brand (domain) owners to sign their data," said John Pescatore, vice president and distinguished analyst, Gartner Research. "Tight integration of key DNSSEC automation functions into the DNS infrastructure will reduce cost and complexity for domain owners. Robust validation solutions eliminate barriers for service providers. Together these capabilities will promote DNSSEC adoption, ensuring Internet stability."

Nominum's authoritative DNS servers - ANS and ANSP - support the industry's only solution that integrates all DNSSEC functions into the DNS server. The solution simplifies network architectures, improves reliability, and reduces capital and operational expenses. Online or offline deployment models for DNSSEC are supported with all of the automation features.

Signing DNS data is compute-intensive and Nominum's new software maximizes performance by dedicating additional processors in multiprocessor platforms to signing. This approach maintains Nominum's industry leading performance and 100 percent availability, even as DNS data is being signed.

For service providers and enterprises that do not want the complexity of DNS and DNSSEC at all, Nominum offers hosted services through SKYE. These services incorporate Nominum's leading technology in a highly reliable cloud-based model. They provide the best DNS security with layered defenses and DNSSEC, managed by experts with zero operational burden.

DNSSEC Already Available for Internet Users

Nominum's massive installed base of Vantio caching DNS servers already support DNSSEC and have validation turned "ON" by default. Unsigned domains are secured with layered defenses that provide the best protection in the industry against cache poisoning. This is critical, since the migration to DNSSEC will take time and some domains may never be signed.

DNSSEC is Not a Panacea

Although DNSSEC will improve DNS security, it does not address other visible Internet threats. Attackers take advantage of the shortcomings of legacy DNS systems to lure users to malicious, illegal or unintended destinations. DNSSEC does not prevent this from happening. Nominum's Intelligent DNS systems apply policy to DNS answers to protect users against phishing, malware-hosting sites, botnets and spam. This ensures Internet users benefit from a safe, secure, and productive Internet experience.

"Deploying DNSSEC is a major undertaking that is going to take many years with growing pains along the way," said Paul Mockapetris, Chief Scientist at Nominum and inventor of the DNS. "There is a pressing need to make it easier for brand owners to protect their domains and provide the best protections to users for unsigned domains during and after this migration."

Availability

DNSSEC features are software only and generally available in Nominum's standard ANS and ANSP authoritative DNS servers, and Vantio caching DNS servers.

About Nominum

Nominum is the leading provider of high-value network-based solutions and applications powered by its world-class DNS and DHCP core engines. Nominum empower fixed and mobile service providers and OEM technology partners to achieve cost efficiencies and extract the highest value from networks by enabling innovative and differentiated offerings. (Learn More)

Related topics: DNS, DNS Security, Security