Michael W. Lucas recently wrote and self-published a new book, DNSSEC Mastery.  He asked me to review it, and I’ve been reading it in bits and starts over the past few very busy weeks.

First, the background: If you’re not familiar with the acronym, it’s a method of securing DNS information so that you can trust that domain name information is actually from the machine that’s supposed to provide it.  DNS information is basic to Internet operation, but it traditionally has been provided without any mechanisms to deal with misinformation or malicious use.  This seems to happen with protocols that have been around for many years, as any mail administrator can tell you…

In any case, ‘DNS poisoning’ (or as Wikipedia calls it, ‘DNS Spoofing‘) attacks such a basic part of how the Internet works that it will completely bypass any security methods that assume name information is correct.  DNSSEC is a way to deal with that.  It introduces public-key encryption into the process of sharing and updating DNS information.  The idea has been around for a while, but it’s only been completely implemented recently.

DNSSEC Mastery goes over this history, and through the setup required to get (recent) BIND working with DNSSEC.  Lucas seems to be starting a series of ‘Mastery’ books, where he covers all the territory around a specific topic.  This one, like his previous title, is exactly what it says.  As long as you have some existing clue around zone files and DNS, the book will take you from no DNSSEC at all to fully implemented in less than 100 pages.  (well, at least in the PDF version, but that gives you an idea of the size.)

Use it to learn, or use it as a quick reference – either way will work.  If you have any DNS server(s) to manage, you’re the target audience.  I expect DNS without these security extensions will go the way of telnet vs. ssh.

A book covering things like new encrypted hash zone record types is going to be a bit dry, but there’s an appropriate sprinkling of humor through the book.  I’ve reviewed other Lucas books before, and I’ve got another on my plate right now, but this is the same: there’s plenty of funny to make the lessons go down easier.

DNSSEC Mastery: Securing the Domain Name System with BIND is available on Amazon, Barnes & Noble, Smashwords, and his self-publishing site.  Also see Peter N. M. Hansteen’s review of the book.