DNSSEC for Hardware Vendors

Registrars, ISPs and end users increasingly need networking equipment and other devices that support and are compatible with a DNSSEC-enabled environment.

Collectively, these entities represent a significant market opportunity for hardware vendors that move quickly to address this need. They also highlight the potential business risks that vendors face if their devices are not DNSSEC-compatible. From a wider perspective, these risks and opportunities underscore the vital role that hardware vendors play in the overall successful deployment and adoption of DNSSEC.

DNSSEC can create a number of compatibility issues in networking equipment that supports DNS. Strategic planning, development and manufacturing cycles that address these issues can take months, if not years. Hardware vendors need to plan, develop, test and refine their products in order to provide for their customers' security needs.

By acting now, you reinforce your reputation for leadership and innovation in internet security, differentiate yourself from competitors, and get a foothold in the DNSSEC-compatible device market.

Benefits for Hardware Vendors

By moving quickly to support the success of DNSSEC globally, you can:

• Introduce upgrades and new products that are compatible with DNSSEC.
• Help build your brand and reputation.
• Maintain customers' trust and loyalty.
• Attract and retain security-focused customers.
• Increase internet security for customers.
• Protect your core business by enhancing trust in the internet.
• Exert leadership and influence to shape the future of DNSSEC.

DNSSEC introduces complex changes to the entire internet ecosystem. To ensure that internet users benefit from this added layer of internet security, manufacturers of internet infrastructure products such as firewalls, routers and other network devices need to ensure that their equipment is compatible with DNSSEC. The proper operation of these products affects virtually anyone who connects to the internet, including businesses, ISPs, home users and other customers.

DNSSEC potentially affects any device that examines internet traffic at layers 3 to 7 of the Open Systems Interconnection (OSI) protocol stack. Compatibility issues may arise from the hardware itself or from how users have configured it. Research suggests that most small office/home office (SOHO) routers (in front of stub resolvers) appear to function properly in a DNSSEC-enabled environment. Business-class firewalls (in front of recursive servers) present the biggest challenge.

Verisign is committed to helping you identify compatibility issues in your products and solutions. The following table provides recommendations for addressing some important considerations related to DNSSEC compatibility.

Verisign wants to help you with device compatibility for DNSSEC. Consider the following steps to get started.

Evaluate and Plan

• Review your existing products to understand their DNSSEC-related limitations and identify factory default settings.
• Understand how DNSSEC fits into your product development strategy.
• Establish a plan for developing products, upgrades and enhancements that support DNSSEC.

Test

Test the compatibility of your network devices with DNSSEC behaviour.

Explore and Educate

• Understand the benefits and challenges that your customers experience when they implement DNSSEC.
• Plan strategies to inform customers about the DNSSEC compatibility of your products.
• Ensure that your IT and customer support staff receive training to handle DNSSEC-related issues.
• Work with industry consortiums, standards bodies and other software and hardware vendors to help develop solutions and approaches that meet the needs of your organisation.