hmLoadTopic({
hmKeywords:"DNS Security Extensions,DNSSEC,Securing DNS,SSL & TLS,SSL & TLS DNSSEC",
hmTitle:"DNSSEC",
hmDescription:"The DNSSEC (DNS Security Extensions) option allows MDaemon to act as a Non-Validating Security-Aware Stub Resolver, which is defined in RFCs 4033 and 4035 as \"an entity that...",
hmPrevLink:"ssl_smtp-extensions.html",
hmNextLink:"ssl_lets-encrypt.html",
hmParentLink:"ssl__certificates.html",
hmBreadCrumbs:"<a href=\"security_menu.html\">Security Menu<\/a> &gt; Security Manager &gt; <a href=\"ssl__certificates.html\">SSL &amp; TLS<\/a>",
hmTitlePath:"Security Menu > Security Manager > SSL & TLS > DNSSEC",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">DNSSEC<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_BodyText_Center\"><img style=\"margin:0 auto 0 auto;width:32.5625rem;height:26.9375rem;border:none\" src=\".\/images\/ssl-tls_dnssec.png\"\/><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">The DNSSEC (DNS Security Extensions) option allows MDaemon to act as a Non-Validating Security-Aware Stub Resolver, which is defined in RFCs <a href=\"https:\/\/tools.ietf.org\/html\/rfc4033\" target=\"_blank\" class=\"weblink\" title=\"Link to RFC-4033\">4033<\/a> and <a href=\"https:\/\/tools.ietf.org\/html\/rfc4035\" target=\"_blank\" class=\"weblink\" title=\"Link to RFC-4035\">4035<\/a> as &quot;an entity that sends DNS queries, receives DNS responses, and is capable of establishing an appropriately secured channel to a security-aware recursive name server that will provide these services on behalf of the security-aware stub resolver.&quot; What this means is that during MDaemon\'s DNS queries it can request DNSSEC service from your DNS servers, setting the AD (Authentic Data) bit in the queries and checking for it in the answers. This can provide an additional level of security during the DNS process for some messages, although not all, because DNSSEC is not yet supported by all DNS servers or for all top-level domains.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">When enabled, DNSSEC service is only applied to messages that meet your selection criteria; it can be requested or required as broadly or narrowly as you choose. Simply designate any &quot;<\/span><span class=\"f_PlainText\">Header Value<\/span><span class=\"f_BodyText\">&quot; combinations you choose on this screen and MDaemon will request DNSSEC service for any messages matching that criteria whenever performing a DNS query. When the DNS results fail to include authenticated data then no negative consequences result; MDaemon simply falls back to normal DNS behavior. If, however, you wish to <\/span><span class=\"f_BodyText\" style=\"font-style: italic;\">require<\/span><span class=\"f_BodyText\"> DNSSEC for certain messages, add &quot;SECURE&quot; to the header\/value combination (e.g. <\/span><span class=\"f_PlainText\">To *@example.net SECURE<\/span><span class=\"f_BodyText\">). For those messages, when the DNS results fail to include authenticated data, the message will be bounced back to the sender. <\/span><span class=\"f_BodyText\" style=\"font-weight: bold;\">Note:<\/span><span class=\"f_BodyText\"> Because DNSSEC lookups take more time and resources, and because DNSSEC is not yet supported by all servers, MDaemon is not configured to apply DNSSEC to every message delivery by default. However, if you wish to request DNSSEC for every message you can do so by included &quot;<\/span><span class=\"f_PlainText\">To *<\/span><span class=\"f_BodyText\">&quot; in your criteria.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Mail session logs will include a line at the top if DNSSEC service was used and &quot;DNSSEC&quot; will appear next to secure data in the logs.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/forbidden_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">Because MDaemon is a non-validating stub-resolver, it will request authenticated data from your DNS server but it has no way to independently verify that the data it gets from the server is secure. For this reason, to successfully use the DNSSEC option you must ensure that you trust your connection to your DNS server. For example, it runs on localhost or within a secure LAN or workplace.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">&nbsp;<\/span><\/p>\n\r"
})
