🌐 Website Issue | DNSSEC support? #731

New Issue

2019-01-21T09:53:08Z

Mikaela commented

2019-01-21 09:53:08 +00:00

(Migrated from github.com)

Description

Why DNSSEC isn't enabled on privacytools.io?

## Description Why DNSSEC isn't enabled on privacytools.io? * [Understanding and configuring DNSSEC in Cloudflare DNS](https://support.cloudflare.com/hc/en-us/articles/360006660072-Understanding-and-Configuring-DNSSEC-in-Cloudflare-DNS) * [DNSSEC Analyzer - privacytools.io](https://dnssec-debugger.verisignlabs.com/privacytools.io)

ghost commented

2019-01-21 14:37:59 +00:00

(Migrated from github.com)

@privacytoolsIO

matsest commented

2019-02-14 11:57:11 +00:00

(Migrated from github.com)

Sites hosted on GitHub Pages does not support DNSSEC (yet). I received this in November after asking them directly:

We really appreciate feedback on how we can make GitHub even better, and I can definitely understand the value of DNSSEC for GitHub Pages.

I can't make any promises as to if or when this might be implemented, but I have added your feedback to our feature request list, and will share it with the team for consideration.

Sites hosted on GitHub Pages does not support DNSSEC (yet). I received this in November after asking them directly: > We really appreciate feedback on how we can make GitHub even better, and I can definitely understand the value of DNSSEC for GitHub Pages. > > I can't make any promises as to if or when this might be implemented, but I have added your feedback to our feature request list, and will share it with the team for consideration.

Mikaela commented

2019-02-14 15:40:57 +00:00

(Migrated from github.com)

Privacytools.io is using Cloudflare for DNS and as a reverse proxy, so GitHub pages not supporting DNSSEC doesn't prevent it. I think there are many pages with similar setup without issues, for example mine (DNSSEC Analyzer link) which until recently had a similar setup, currently I am only using Cloudflare for www.

Of course GitHub pages not supporting DNSSEC would leave Cloudflare's DNS servers vulnerable to cache poisoning while flattening the CNAME, but I don't think that is too different from the case with Cloudflare as reverse proxy as we cannot know what SSL options privacytools.io is using, is GitHub pages contacted over http, https (invalid certificate accepted) or https (valid certificate required).

Privacytools.io is using Cloudflare for DNS and as a reverse proxy, so GitHub pages not supporting DNSSEC doesn't prevent it. I think there are many pages with similar setup without issues, for example [mine (DNSSEC Analyzer link)](https://dnssec-debugger.verisignlabs.com/mikaela.info) which until recently had a similar setup, currently I am only using Cloudflare for www. Of course GitHub pages not supporting DNSSEC would leave Cloudflare's DNS servers vulnerable to cache poisoning while flattening the CNAME, but I don't think that is too different from the case with Cloudflare as reverse proxy as we cannot know what SSL options privacytools.io is using, is GitHub pages contacted over http, https (invalid certificate accepted) or https (valid certificate required).

matsest commented

2019-02-14 16:22:22 +00:00

(Migrated from github.com)

@Mikaela Oh, I did not know about the setup with using it as a reverse proxy and I'm somewhat confused over GitHub's support pages regarding this, resulting in my correspondence with them.

From my experience with Github using the "regular" setup for DNS with a apex and subdomain with the CNAME my site fails in DNSSEC validation when it gets to the github.io in the io zone. I see that this is a somewhat different case than for privacytools, so perhaps this could be easily resolved :)

Edit: I changed my setup to using apex domain and A records at my registrar instead of using www and CNAME and now it works with DNSSEC as intended. Thanks for the clarifying comments! Then this site should be able to activate it to.. ;)

@Mikaela Oh, I did not know about the setup with using it as a reverse proxy and I'm somewhat confused over GitHub's support pages regarding this, resulting in my correspondence with them. From my experience with Github using the "[regular](https://help.github.com/articles/setting-up-an-apex-domain-and-www-subdomain/)" setup for DNS with a apex and subdomain with the CNAME my site [fails in DNSSEC validation](https://dnssec-debugger.verisignlabs.com/www.mxe.no) when it gets to the github.io in the io zone. I see that this is a somewhat different case than for privacytools, so perhaps this could be easily resolved :) Edit: I changed my setup to using apex domain and A records at my registrar instead of using www and CNAME and now it works with DNSSEC as intended. Thanks for the clarifying comments! Then this site should be able to activate it to.. ;)

Mikaela commented

2019-02-14 19:07:41 +00:00

(Migrated from github.com)

I don't know what was your original message to GitHub support, but from their response I think they were talking about GitHub pages without custom domain, <username>.github.io, but that should fix your issue.

(Sorry if I am not making much sense, I am multitasking.)

I don't know what was your original message to GitHub support, but from their response I think they were talking about GitHub pages without custom domain, `<username>.github.io`, but that should fix your issue. (Sorry if I am not making much sense, I am multitasking.)

privacytoolsIO commented

2019-03-30 10:46:22 +00:00

(Migrated from github.com)

Is this correct now? Thanks for your help, guys.

<img width="491" alt="DNSSEC" src="https://user-images.githubusercontent.com/11730911/55275101-15b6c500-531c-11e9-8c8a-604f85ea6ff3.png"> Is this correct now? Thanks for your help, guys.

👍 1 🎉 1

Mikaela commented

2019-03-30 23:15:12 +00:00

(Migrated from github.com)

Thank you 💜

Thank you :purple_heart:

Mikaela commented

2019-03-30 23:20:39 +00:00

(Migrated from github.com)

However this may have slowed migrating out of Cloudflare, unless you can find more information on DNS transitioning DNSSEC-signed domains than I did. See https://github.com/privacytoolsIO/privacytools.io/issues/374#issuecomment-476564807 for my experience on Cloudflare -> Gandi.net

This repo is archived. You cannot comment on issues.