New features simplify and automate DNSSEC deployment without proprietary appliances

Redwood City, Calif. – November 18, 2009 — Nominum, the leader in intelligent DNS solutions today announced new capabilities that eliminate barriers to DNSSEC deployment.  The solution completely integrates functions needed to successfully deploy DNSSEC at any scale without costly proprietary appliances. In addition, automation of DNSSEC processes eliminates operational overhead and errors that could cause Internet sites to disappear. Nominum now has the strongest possible protections for Internet users relying on both signed and unsigned DNS data.  These new features strengthen Nominum’s unique layered defenses embedded in the Vantio caching DNS servers that protect over 170 million broadband households.   

"One of the grand challenges the Internet faces is: How do we make security scale?  With over 61% of compromises being traced to authentication flaws, we clearly have a big problem.  DNSSEC is the big solution that we need to fix authentication,” said Dan Kaminsky the security researcher who identified a key flaw in DNS security in 2008.  “And there is progress:  I have been proud to see, in the wake of my DNS vulnerability finding, a steady drumbeat towards signatures at the Root and TLD layers.  But large organizations need it to be easier and less disruptive to deploy DNSSEC, before they can reasonably be expected to secure their own domain names.  That is why I am happy to see Nominum adding comprehensive DNSSEC support to their DNS server platforms -- and even happier to see DNSSEC almost entirely automated within it.  DNSSEC can, should, and must “Just Work”, and Nominum has done an excellent job making that so."

Simplifying DNSSEC Deployment for Brand Owners and Service Providers
Today, brand owners have well understood procedures to publish and update DNS data that convey their brands ([email protected], www.nominum.com).  Introducing DNSSEC adds many new complex functions that must be implemented flawlessly or Internet sites disappear.  Nominum integrated and automated these critical functions into existing DNS servers.  DNSSEC processes that previously took additional equipment such as external “signing” appliances are now Nominum software features running on commodity server hardware.  Complex multi-step manual operations that required expert intervention and frequent repetition can now be executed with a few keystrokes, once, by existing staff.  Eliminating intensive and repetitive manual effort removes the need for specialized expertise, prevents errors that result in service outages, and reduces costs.   

“Since the Kaminsky vulnerability, a lot of progress has been made in DNSSEC deployment with various top level domains signed or committed to be signed. The next battleground in DNSSEC adoption will be in getting brand (domain) owners to sign their data,” said John Pescatore at Gartner Group.  “Tight integration of key DNSSEC automation functions into the DNS infrastructure will reduce cost and complexity for domain owners.  Robust validation solutions eliminate barriers for service providers. Together these capabilities will

Nominum’s authoritative DNS servers - ANS and ANSP - support the industry’s only solution that integrates all DNSSEC functions into the DNS server.  The solution simplifies network architectures, improves reliability, and reduces capital and operational expenses.  Online or offline deployment models for DNSSEC are supported, with all of the automation features.   

Signing DNS data is compute intensive and Nominum’s new software maximizes performance by dedicating additional processors in multiprocessor platforms to signing. This approach maintains Nominum’s industry leading performance and 100% availability even as DNS data is being signed.

For service providers and enterprises that do not want the complexity of DNS and DNSSEC at all, Nominum offers hosted services through SKYETM.  These services incorporate Nominum’s leading technology in a highly reliable cloud based model.  They provide best DNS security with layered defenses and DNSSEC managed by experts, with zero operational burden. 

DNSSEC Already Available for Internet Users
Nominum’s massive installed base of Vantio caching DNS servers already support DNSSEC and have validation turned “ON” by default. Unsigned domains are secured with layered defenses that provide the best protection in the industry against cache poisoning. This is critical since the migration to DNSSEC will take time and some domains may never be signed. 

DNSSEC is Not a Panacea
Although DNSSEC will improve DNS security, it does not address other visible Internet threats.  Attackers take advantage of the shortcomings of legacy DNS systems to lure users to malicious, illegal or unintended destinations. DNSSEC does not prevent this from happening. Nominum’s Intelligent DNS systems apply policy to DNS answers to protect users against phishing, sites that distribute malware, botnets and spam. This ensures Internet users benefit from a safe, secure and productive Internet experience.

“Deploying DNSSEC is a major undertaking that is going to take many years, with growing pains along the way.” said Paul Mockapetris, Chief Scientist at Nominum and inventor of the DNS. “There is a pressing need to make it easier for brand owners to protect their domains and provide the best protections to users for unsigned domains during and after this migration.”

Availability
DNSSEC features are software only and generally available in Nominum’s standard ANS and ANSP authoritative DNS servers, and Vantio caching DNS servers.