Comcast launches first public U.S. trial of advanced DNS security

New security mechanism aims to protect web operators and consumers from specific hijacking hack attacks

Comcast unveiled on Tuesday an aggressive plan to deploy new DNS security mechanisms that are designed to protect Web site operators and consumers from a specific type of hacking attack that involves hijacking Web traffic and redirecting it to bogus sites.

In a blog post, Comcast said it has deployed DNS Security Extensions -- dubbed DNSSEC -- throughout its nationwide network and will immediately make validating servers available to any of its customers that want to experiment with this emerging security technique.

In addition to this public trial of DNSSEC validation services, Comcast says it will digitally sign all of its own domain names -- more than 5,000 in total -- using DNSSEC by the first quarter of 2011.

By the end of 2011, Comcast says it will have production-quality DNSSEC resolution services available to all of its business and residential customers.

"There is often talk about a chicken-and-egg sort of problem with DNSSEC. People don't want to sign their own domains with DNSSEC until people are validating signatures," says Jason Livingood, Executive Director of Internet Systems Engineering at Comcast. "We want to explain how we as an ISP have a road map for validating signatures with DNSSEC."

DNSSEC is an Internet standard that prevents spoofing attacks by allowing Web sites to authenticate their domain names and corresponding IP addresses using digital signatures and public-key encryption. When DNSSEC is fully deployed, Internet users will be able to verify that the Web sites they visit are digitally signed.

Comcast is believed to be the first U.S. carrier to announce plans to support resolution of DNSSEC queries for its customers as well as to sign its own domain names using DNSSEC.

"There are no large U.S. ISPs that have been publicly resolving and signing using DNSSEC in a large trial. But there are lots of people doing small little tests of DNSSEC," says Paul Hoffman, Director of the VPN Consortium and an active participant in DNSSEC standards development work by the Internet Engineering Task Force.

Hoffman says until now no U.S. carrier has committed to DNSSEC resolution, which could be a stumbling block to DNSSEC deployment.

"Many people have been worried that there would be a lot of people signing their domain names, and no one checking for the resolution," Hoffman says. "A major ISP doing both halves of the equation with DNSSEC is a big deal."

DNSSEC is a hierarchical system, and it requires authentication at every step in the process of matching a domain name with the corresponding IP address. In order for a user to receive an authenticated response from a popular Web site such as, DNSSEC needs to be deployed on the Internet's root servers, the .com domain servers operated by VeriSign, and the DNS servers operated by Amazon or its Web-hosting company. Consumers who visit Amazon's Web site also need their ISPs to validate the digital signature they receive.

DNSSEC is in the process of being deployed across the Internet's infrastructure. The DNS root servers will be signed in July, and VeriSign has committed to supporting DNSSEC on the .com and .net servers by early 2011. The U.S. federal government is deploying DNSSEC across the .gov domain, and the Public Interest Registry is supporting DNSSEC in .org.

Once the DNS root servers as well as popular top-level domains such as .com and .net are signed, DNSSEC is expected to be widely adopted by Web site operators such as Amazon.

Until now, U.S. ISPs have been slow to commit to DNSSEC. That's why Comcast's DNSSEC announcement is significant.

"The intention of the trial is to see what things [happen] operationally with DNSSEC and to get ready to do this for the entire customer base once the root is signed and once the major top-level domains are signed," Livingood says.

Comcast said its public trial of DNSSEC includes immediate availability of DNSSEC validating servers using an Internet addressing and routing scheme known as Anycast.

Comcast has 12 sites across its network that process and cache DNS queries, and all 12 of these locations will handle DNSSEC resolution during the public trial.

"Our subscribers should be able to expect the same level of service for our DNSSEC servers as with our regular DNS servers," Livingood says. He added that "the critical difference with this trial is that DNSSEC will be on the servers that are very close to the customers just as the nomral DNS servers are so they won't see a performance hit when they are using these on a trial basis."

Until the DNS root servers are signed, Comcast will use what's called a trust anchor repository to validate DNSSEC queries at the top of the DNS tree. Comcast is using IANA's trust anchor repository for its public DNSSEC trial.

Comcast is promising an easy transition to production-level DNSSEC resolution services for its customers.

"When we turn on DNSSEC for all of our customers nationally in 2011, it will happen automatically," Livingood says. "We will have tested it, and it will be seamless. People will not have to change their IP addresses. It will all occur behind the scenes."

Comcast also revealed its roadmap for signing its own domain names by March 2011. Comcast already has end-to-end DNSSEC validation on several domains including, and .

"We have 5,000 top-level domains that we manage like that we're talking about signing," says Chris Griffiths, manager for high-speed Internet engineering at Comcast.

Comcast is using Nominum's authoritative DNS software for its DNSSEC trial and deployment.

"Comcast is one of Nominum's largest DNS customers and has long been a model for the industry on how to do DNS right," Nominum said in a statement. "Their plan to deploy our DNSSEC solution to combat cache poisoning and help mitigate other online threats is a significant milestone in the evolution of DNS technology and will help make the Internet a safer place for everyone."

Comcast said that the cost of deploying DNSSEC for both resolving queries and signing its domains is minimal.

"It's not a huge investment," Livingood says. "We upgraded the hardware on the servers in the past six months to be able to handle the computational load for signing this number of domains. But it hasn't required a substantial investment, although we have been working closely with our vendors to make sure the tools were easy to use and that it was not an onerous process."

Comcast has been experimenting with DNSSEC since 2008, when a high-profile flaw in the DNS -- commonly known as the Kaminsky Bug -- was revealed. DNSSEC is the only long-term fix for preventing Kaminsky-style attacks.

"Back then, we started working on all the operational issues of how difficult it is to sign zones, how difficult it is to do key roll-over and what are the challenges related to validating domains," Livingood says. "We sent a lot of feedback to the vendors we use…We think we're at the stage where a lot of this stuffy is ready to use."

Comcast is hoping that its public trial of DNSSEC resolution services and its commitment to signing its own domains will prompt other carriers to follow suit.

"What we're really trying to do is announce our own plans so that we can be a catalyst for others to take action and get serious about DNSSEC," Livingood says. "We're trying to move the Internet community ahead on DNSSEC."

Join the PC World newsletter!

Error: Please check your email address.

Tags DNS securityhijackingcomcast

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Carolyn Duffy Marsan

Network World
Show Comments

Most Popular Reviews

Latest News Articles


PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?