Saturday, February 1, 2014

DNSSEC/DANE/TLSA Browser Add-ons

The folks at CZ.NIC (the operators of the Czech Republic's country-code top level domain: .cz) have created a set of web browser add-ons to perform DNSSEC/DANE/TLSA validation. You can read about them and download them from their website:

I installed the Firefox web browser plugin and did some quick tests of them on my own website. The plugin installs two new icons on the right side of the browser's location (URL) bar. The first with a key on it shows information about whether the domain name for the website has a valid DNSSEC signature associated with it. The second icon with a lock on it shows information about whether the TLS certificate of the website can be authenticated with a DANE TLSA record. Here are screenshots with my own website ( ).

In this first screenshot (below), I clicked on the key icon, and it reports that the ''  domain name has a valid DNSSEC signature.

In the next screenshow (below), I clicked on the lock icon, and it reports that the certificate for has been successfully authenticated by means of a signed TLSA record.

In this case, since this is an HTTPS connection at the standard port (TCP port 443), the plugin looked for the TLSA record at the domain name ""

    $ dig TLSA +noall +answer
   [...] 7200 IN TLSA 3 0 1 (
                    25B267A1D92F0410890B ) 7200 IN RRSIG TLSA 8 5 7200 (
                    20140217205026 20140118205010 14703
                    rK3w8r6tdNF4gXqIM3sQlz9gPY/WOu0zxjezaIk= )

Below is another screenshot for In this case, the second icon has a cross marked on it, meaning that no TLSA record was found for this site. Apparently, the IETF is not yet eating its own dogfood. Although see this short slide deck from IETF'87 - there appears to be a proposal to do so.

There are a few configuration options that can be set for the add-on. Here is a view of the settings window:

The plug-in appears to do its own DNS resolution (and validation) by default. But you can also choose to use DNS resolvers configured for your system, or a customer resolver such as the Google public resolver (

If you need help creating a TLSA record for your website, I have a web based tool available here:

One thing I should mention, in case you're looking at the configuration of my website: does not today have a secure delegation (i.e. DS record) published in its parent zone. This is because the registrar I use, Network Solutions, still cannot process requests to install DS records. I did quick check on their website (again) to see if anything's changed. Doesn't appear so:

Instead, I've had DLV record published in the ISC DLV Registry. But there are several big resolver services, like Google DNS, and Comcast, that do not perform lookaside validation, so it's probably time to switch registrars. If anyone has suggestions for competent DNSSEC enabled registrars (with registrar-lock support), I'd be happy to receive them. I hope to make the switch soon.

Dan York from ISOC also has an article on these addons here. (I started writing this before seeing his!)

--Shumon Huque

Addendum (May 2014): my domain now has a secure delegation from .COM.


  1. DANE is an SSL extension that allows websites to be independent of Certificate Authorities and their potentially fake SSL certificates.

  2. Homework help services offers you the most affordable but excellent custom writing services & assistance by professional qualified writers of USA.

  3. I have really enjoyed reading your blog posts. Any way I’ll be subscribing to your feed and I hope you post again soon. Moreover your blog post will be a great addition to pay tax for small business which was produced for me by the professional business man I will definitely receive the highest rank for this work for both your helps.

  4. Woah! That is some great stuff, I just submitted my friend a file who had asked me to write my dissertation cheap and now I am learning about websites here – this feels like such a knowledgeable day for me. Haha! Anyways, thank you for sharing this.

  5. the men black biker jacket is beloved by people of all professions. Perfect for a range of casual ensembles, this jacket is comfortable and highly versatile. available at

  6. And we're not just your average bodyguard services in UK
    London chauffeur services as UK Close Protection Services are an established premium executive provider of close protection and body guarding provisions, as well as car hire, and are renowned as the best bodyguard as well as chauffeur company in London. We are the premiere provision of highly-trained, discreet and professional bodyguards and security drivers in London.

  7. Thank you for this great contribution, I find it very interesting and well thought out and put together. I hope to read your work in the future. aviator jacket women

  8. Get markdown codes, vouchers, voucher codes and free improvement offers for huge number of UK stores and brands at You can get a decent strategy on devices.
    By: riding hat

  9. time tracking software Do you think why it is more important? Well, it allows you to keep a check on tasks that you need to perform

  10. Woah! That's some fantastic information; I recently sent a file to a buddy who had requested cheap essay assistance, and now I'm learning about websites here – it's been a very informative day for me. Haha! Anyway, I appreciate you sharing this.

  11. his is one of the best blog it is increased my knowledge a lot ! payroll services

  12. Understudy life is viewed as the brilliant time of an individual's life. What's more, why not, overflowing with happiness and astonishing encounters stay in the recollections for eternity. There are numerous things that an understudy needs to best paper writers defeat for getting his/her higher auxiliary, graduate, postgraduate, or more significant level degree. Out of which, one significant undertaking can be recognized as task composing.

  13. Assuming that you're hoping to make a slick appearance, you ought to leave your Men Slim Fit Red Leather Jacket or cowhide coat unfastened or unfastened. Doing so will give more choices to redo your appearance. For example, you can wear a shirt or top that differences with the shade of your calfskin coat.

  14. Thanks for sharing this useful and helpful content may be this link also very useful for others

    how to sell mobile phone online

  15. Thanks for sharing this useful and helpful content may be this link also very useful for others
    how to sell mobile phone online

  16. Utilize cutting-edge lighting and Eglo lighting productssmart home technology to enter the twenty-first century. Numerous improvements

  17. We offer our players a distinctive Dota2 Middle East in Dubaiand dependable platform that offers a range