DNSSEC

Since IPFire 2.15 core update 80 IPFire comes with DNSSEC enabled by default. That means that all DNS responses are verified so that DNS spoofing is not possible any more.

Before IPFire 2.19 core update 106, this required that the DNS servers the IPFire DNS proxy forwards queries to also must verify DNS responses. Because dnsmasq did not recursively resolve DNS queries, it needs to know if the domain supports DNSSEC and will then execute a verification for the requested DNS record. This limitation was removed after replacing dnsmasq with unbound.

How does DNSSEC work?

Check out this great YouTube video that explains how DNSSEC validation works:
YouTube - How Does DNS Works : Resolving DNS With DNSSEC

How to check if DNSSEC is working?

In order to find out if your system properly works with DNSSEC, check out the DNSSEC resolver test from Universität Duisburg-Essen.

Further Reading

• Domain Whitelisting
• Hosted Blacklists
• IPFire Blog articles:
  • 18 Nov 2016 - Rolling out DNSSEC to the masses
  • 9 Sep 2018 - DNSSEC key rollover soon
  • 4 Aug 2020 - DNS configuration recommendations for IPFire users