DNSSEC Secures Another Domain (.edu)

Via DarkReading.com -

Education and academic community domain .edu is about to become the next top-level domain adopt the Domain Name Systems (DNS) security protocol.

Domains ending in .edu will be able to digitally sign their domains with DNSSEC by the end of next March. DNSSEC is basically an extra layer of authentication that helps protect the DNS translation process from being compromised by attackers.

DNSSEC has been gaining momentum during the past year in the wake of researcher Dan Kaminsky's finding of a major DNS cache poisoning flaw. The .org domain is signed, federal agencies must adopt DNSSEC by December for their .gov domains, and new FISMA regulations call for agencies to sign their intranet zones with DNSSEC by the middle of next year. And VeriSign plans to sign .net with DNSSEC by the end of 2010, and .com in early 2011.

While .edu's move to DNSSEC will allow institutions to digitally sign their domain names, security experts and officials say just when or if the registrants themselves will go DNSSEC is unclear. "The first step is to make the necessary changes in the zone so that individual registrants can take advantage of it," says Steve Worona, director of policy and networking programs for EDUCAUSE, which operates the .edu domain. "And it's [their] decision of when and whether they will sign their [domain]."

The .edu domain is one of the smallest, with about 6,000 registrants, but its adoption of DNSSEC could serve as a case study for the larger domains, Worona says. "This is quite a technologically savvy community [as well]. People understand what DNSSEC is and what its value would be," he says.