Home / Industry

Nominum Announces "DNSSEC Made Easy" Solutions

Nominum, the leader in intelligent DNS solutions, today announced new capabilities that eliminate barriers to DNSSEC deployment. Nominum's latest software release completely integrates functions needed to successfully deploy DNSSEC at any scale without costly proprietary appliances. In addition, automation of DNSSEC processes eliminates operational overhead and errors that could cause Internet sites to disappear. Coupled with unique layered defenses, Nominum now has the strongest possible protections for Internet users relying on both signed and unsigned DNS data. These new features are available in Nominum's industry leading DNS servers (ANS, ANSP, and Vantio), or with SKYE™, its highly secure and reliable hosted service offering for service provider and enterprise customers worldwide.

"One of the grand challenges the Internet faces is: How do we make security scale? With over 61 percent of compromises being traced to authentication flaws, we clearly have a big problem. DNSSEC is the big solution that we need to fix authentication," said Dan Kaminsky, the security researcher who identified a key flaw in DNS security in 2008. "And there is progress. I have been proud to see, in the wake of my DNS vulnerability finding, a steady drumbeat towards signatures at the Root and TLD layers. But large organizations need it to be easier and less disruptive to deploy DNSSEC before they can reasonably be expected to secure their own domain names. That is why I am happy to see Nominum adding comprehensive DNSSEC support to their DNS server platforms — and even happier to see DNSSEC almost entirely automated within it. DNSSEC can, should, and must "just work", and Nominum has done an excellent job making that so."

Simplifying DNSSEC Deployment for Brand Owners and Service Providers

Today, brand owners have well understood procedures to publish and update DNS data that convey their brands (mail@nominum.com, www.nominum.com). Introducing DNSSEC adds many new complex functions that must be implemented flawlessly or Internet sites may disappear. Nominum has integrated and automated these critical functions into its existing DNS servers. Now, DNSSEC processes that previously required additional equipment such as external "signing" appliances are included in Nominum software running on commodity server hardware. Complex multi-step manual operations that required expert intervention and frequent repetition can now be executed once, with a few keystrokes by existing staff. Eliminating intensive and repetitive manual effort removes the need for specialized expertise, prevents errors that result in service outages and reduces costs.

"Since the Kaminsky vulnerability, a lot of progress has been made in DNSSEC deployment with various top level domains signed or committed to be signed. The next battleground in DNSSEC adoption will be in getting brand (domain) owners to sign their data," said John Pescatore, vice president and distinguished analyst, Gartner Research. "Tight integration of key DNSSEC automation functions into the DNS infrastructure will reduce cost and complexity for domain owners. Robust validation solutions eliminate barriers for service providers. Together these capabilities will promote DNSSEC adoption, ensuring Internet stability."

Nominum's authoritative DNS servers - ANS and ANSP - support the industry's only solution that integrates all DNSSEC functions into the DNS server. The solution simplifies network architectures, improves reliability, and reduces capital and operational expenses. Online or offline deployment models for DNSSEC are supported with all of the automation features.

Signing DNS data is compute-intensive and Nominum's new software maximizes performance by dedicating additional processors in multiprocessor platforms to signing. This approach maintains Nominum's industry leading performance and 100 percent availability, even as DNS data is being signed.

For service providers and enterprises that do not want the complexity of DNS and DNSSEC at all, Nominum offers hosted services through SKYE. These services incorporate Nominum's leading technology in a highly reliable cloud-based model. They provide the best DNS security with layered defenses and DNSSEC, managed by experts with zero operational burden.

DNSSEC Already Available for Internet Users

Nominum's massive installed base of Vantio caching DNS servers already support DNSSEC and have validation turned "ON" by default. Unsigned domains are secured with layered defenses that provide the best protection in the industry against cache poisoning. This is critical, since the migration to DNSSEC will take time and some domains may never be signed.

DNSSEC is Not a Panacea

Although DNSSEC will improve DNS security, it does not address other visible Internet threats. Attackers take advantage of the shortcomings of legacy DNS systems to lure users to malicious, illegal or unintended destinations. DNSSEC does not prevent this from happening. Nominum's Intelligent DNS systems apply policy to DNS answers to protect users against phishing, malware-hosting sites, botnets and spam. This ensures Internet users benefit from a safe, secure, and productive Internet experience.

"Deploying DNSSEC is a major undertaking that is going to take many years with growing pains along the way," said Paul Mockapetris, Chief Scientist at Nominum and inventor of the DNS. "There is a pressing need to make it easier for brand owners to protect their domains and provide the best protections to users for unsigned domains during and after this migration."


DNSSEC features are software only and generally available in Nominum's standard ANS and ANSP authoritative DNS servers, and Vantio caching DNS servers.


About Nominum – Nominum is the innovation leader in DNS software and Internet Activity Applications. The company's Vantio™ CacheServe software powers the Internet for the world's largest CSPs in 40 countries. Vantio™ ThreatAvert software arms CSP's with the power to stop the spread of inside threats such as botnets and DNS-based DDoS amplification attacks that could impact network availability and reputation. Nominum's N2 applications enable CSP's marketing and customer care teams to leverage subscribers' Internet Activity to better engage, build brand loyalty, improve marketing ROI, and open up new business models. Nominum is a global organization headquartered in Redwood City, CA. Learn More

Related topics: Cybersecurity, DNS, DNS Security


Don't miss a thing – get the Weekly Wrap delivered to your inbox.

Related Blogs

Related News

Explore Topics

Dig Deeper

IP Addressing

Sponsored by Avenue4 LLC

Mobile Internet

Sponsored by Afilias Mobile & Web Services


Sponsored by Verisign

DNS Security

Sponsored by Afilias

Promoted Posts

Buying or Selling IPv4 Addresses?

ACCELR/8 is a transformative IPv4 market solution developed by industry veterans Marc Lindsey and Janine Goodman that enables organizations buying or selling blocks as small as /20s to keep pace with the evolving demands of the market by applying processes that have delivered value for many of the largest market participants. more»

Industry Updates – Sponsored Posts

Verisign Named to the Online Trust Alliance's 2017 Audit and Honor Roll

Attacks Decrease by 23 Precent in 1st Quarter While Peak Attack Sizes Increase: DDoS Trends Report

Leading Internet Associations Strengthen Cooperation

Global Domain Name Registrations Reach 329.3 Million, 2.3 Million Growth in Last Quarter of 2016

Verisign Releases Q4 2016 DDoS Trends Report: 167% Increase in Average Peak Attack from 2015 to 2016

Neustar to be Acquired by Private Investment Group Led by Golden Gate Capital

Verisign Q3 2016 DDoS Trends Report: User Datagram Protocol (UDP) Flood Attacks Continue to Dominate

2016 U.S. Election: An Internet Forecast

Government Guidance for Email Authentication Has Arrived in USA and UK

ValiMail Raises $12M for Its Email Authentication Service

Don't Gamble With Your DNS

Defending Against Layer 7 DDoS Attacks

Understanding the Risks of the Dark Web

New TLD? Make Sure It's Secure

Verisign Releases Q2 2016 DDoS Trends Report - Layer 7 DDoS Attacks a Growing Trend

How Savvy DDoS Attackers Are Using DNSSEC Against Us

Radix Adds Dyn as a DNS Service Provider

Facilitating a Trusted Web Space for Financial Service Professionals

MarkMonitor Partners with CYREN to Deepen Visibility into Global Phishing Attacks

Verisign Named to the Online Trust Alliance's 2016 Honor Roll