Want to Deploy DNSSEC on Microsoft Windows 7 or Server 2008 R2?

MS DNSSEC Deployment GuideDo you operate a Microsoft Windows server infrastructure and would like to know how to implement DNSSEC? If so, Microsoft published a “DNSSEC Deployment Guide” to help administrators of Windows Server 2008 R2 and Windows 7 systems.

The comprehensive document explains what DNSSEC is all about, walks step-by-step through each process and also provides easy checklists to use as a reference during deployment and ongoing operation.

I no longer administer Windows Servers so can’t personally attest to the usefulness of the guide.  In reading through it, my initial reaction is that there seems to be very little GUI management of DNSSEC. Most of the administration seems to involve use of the ‘dnscmd’ command-line tool.  While that’s perfectly fine by me, given that I’ve a big command-line fan, I suspect that many regular Windows administrators may wish they could execute these commands through one of the administration tools Microsoft provides. The document also was last updated in March 2010 and thus pre-dates the signing of the root in July 2010. With the root signed, the section on distributing trust anchors may no longer be quite as applicable.

Regardless, this appears to be the most recent document provided by Microsoft and so if you have a Windows-based server infrastructure you may want to check it out.  I’d note that this document only applies to Windows Server 2008 R2 and Windows 7.  Earlier versions of Windows Server had much more limited support for DNSSEC.

If you are a Windows administrator, what do you think?  Is this document helpful? Useful?  What could Microsoft do to make DNSSEC deployment easier on Windows Server 2008 R2 or Windows 7?

February 16th, 2012 by | Posted in DNSSEC, Whitepapers | 4 Comments

4 Responses to Want to Deploy DNSSEC on Microsoft Windows 7 or Server 2008 R2?

  1. This document proves that 2008 R2 can’t be used as either validating resolver or authoritative DNS with signed domains. It’s to complicated and nothing is automated.

  2. Roger thames says:

    in server 2012 Microsoft has made some major changes in DNSSEC deployment.
    I found a good article on it @

    http://securebits.in/dnssec-changes-and-deployment-windows-server-2012/

    • Dan York says:

      Roger,

      Many thanks for that update/link and I’ll call that out in a blog post this week.

      Thanks,
      Dan

Leave a Reply

Your email address will not be published. Required fields are marked *