{"id":53767,"date":"2019-10-10T13:00:43","date_gmt":"2019-10-10T18:00:43","guid":{"rendered":"https:\/\/blog.cpanel.com\/?p=53767"},"modified":"2019-10-10T13:00:43","modified_gmt":"2019-10-10T18:00:43","slug":"dnssec-clustering-now-available-with-powerdns","status":"publish","type":"post","link":"https:\/\/devel.www.cpanel.net\/blog\/products\/dnssec-clustering-now-available-with-powerdns\/","title":{"rendered":"DNSSEC Clustering Now Available with PowerDNS"},"content":{"rendered":"\n
In the event you missed it, we published a blog post back in December of 2018, announcing the deprecation of MyDNS and NSD. Now that PowerDNS<\/a> has been the choice DNS Management tool of cPanel & WHM for several versions, the request for DNSSEC (Domain Name System Security Extensions) clustering has become even more popular. <\/p>\n\n\n\n Well, you’ve been asking for it, and we’re ready to deliver it. Coming with cPanel & WHM Version 84 and beyond, we are offering DNSSEC Clustering with PowerDNS.<\/p>\n\n\n\n DNSSEC combined with our DNS Clustering feature, provides the means to add security to your DNS clusters, using digital signatures and cryptographic keys to validate that DNS responses are authentic, thereby creating a “chain of trust.” This includes notifications for the system administrator with the assurance that the zone records and DNSSEC are validated and working for cluster members, or notice that there is an issue. Essentially, DNSSEC complicates the manipulation of information that passes through DNS.<\/p>\n\n\n\n With the launch of Version 84, we’ve added the ability to change a DNS server’s nameserver software in WHM’s DNS Cluster<\/a> interface (WHM >> Home >> Clusters >> DNS Cluster<\/em>), allowing a user to upgrade their DNS cluster members from BIND to PowerDNS by clicking the Upgrade<\/em> link in the Status<\/em> column of the Servers in your DNS Cluster<\/em> table. We’ve also added error handling for misconfigured DNS clusters, as well as DS record validity checks. Additional DNSSEC clustering performance improvements are expected in upcoming versions as we continue development.<\/p>\n\n\n\n
DNSSEC gives users protection from a litany of attacks, such as DNS spoofing<\/a> or Man-in-the-Middle Attacks<\/a>. Designed as a scalable distributed system, DNSSEC was built to protect applications and in turn, the caching resolvers that serve those applications. Digital signatures using public-key cryptography to sign DNS data are the critical component of DNSSEC’s DNS authentication strengthening ability. Answers to queries from DNSSEC protected zones are digitally signed, giving the DNS resolver the ability to check that the information is complete and unmodified from the zone owner published information and served on an authoritative DNS server.<\/p>\n\n\n\n