What is the EnableDnsSec property from the Get-DnsServerSetting cmdlet

Question

What is the EnableDnsSec property from the Get-DnsServerSetting cmdlet and is it set somewhere in the gui? I have several ad integrated dc\dns member servers in a domain and on one of them (a 2016 server as opposed to the other 2021r2 servers) the EnableDnsSec is set to false. In theory they should all be the same?

Answer 1

In theory, yes they should all be configured the same. Yes, you can set this using the UI.

In actual use, a DNS client (or other server) receives the same an address information from the query. What's missing from the process if the information is received from a zone not using DNSSEC is the ability to verify that the answer came from the correct source. DNSSEC is there to prevent DNS spoofing and using date created by cache poisoning.

See here for more information: dn593694(v=ws.11)

Answer 2

How do I see it via the gui? So if the EnableDnsSec property of a Get-DnsServerSetting is set to True, at least one zone from a get-dnsserverzone output should have property issigned as true?

Answer 3

Before you can enable DNSSEC you have to add a "Trust Point" which will add the key used to produce the signature in the new DNS records that are used to validate the contents of the associated resource record.

It sounds to me that you need help understanding DNSSEC, not how to accomplish the task using PowerShell.

FYI, you can find the "Trust Points" in the hierarchy beneath the server in the GUI.

Answer 4

The thing that I am trying to solve is this: I have lets say 5 domain controllers in a domain. They are all running Ad integrated dns. On 4 of the servers EnableDnsSec property of a Get-DnsServerSetting is set to True. These 4 dcs are server 2012r2. On the fifth dc the EnableDnsSec property of a Get-DnsServerSetting is set to false. This server is a newer server 2016. When I run get-dnsserverzone on all the dcs all the zones return a false for the issigned property so that should mean dnssec even if enabled somewhere is not used. I am trying to figure out the reason for the discrepancy between the 4 servers with the setting set to true and the one set to false. I know I can probably enable it via a set-dnsserversetting but I want to know where it is enabled on the other servers to understand why it is enabled.

Answer 5

I guess in the gui in 2016 the setting is missing. Only able to set via command line and powershell https://serverfault.com/questions/862378/dnssec-broken-in-windows-2016s-dns-server