How do I make an iOS application * * required * DNSSec?

Question

I need to make sure that my iOS application requires DNSSec when connecting to a specific server. How can I make sure that DNS calls always use this?

Answer 1

You need to include the DNS library in the source code. Try using libunbound. With libunbound you can check the DNSSEC response. In doing so, you can try to use DANE to protect your SSL certificate.

Answer 2

DNSSEC is available at OS level with iOS 10+ as part of the dnssd Framework . You use it using the kDNSServiceFlagsValidate flag when querying DNS using DNSServiceQueryRecord .

If you want to protect your TLS connection, you need to fulfill the dns request in URLSessions urlSession(_:didReceive:completionHandler:) .

However, you should be aware that there are public DNS servers (such as OpenDNS) that do not support DNSSEC .

Answer 3

Since DNSSEC is not available at the OS level, I think the best option you have is to protect your application by checking your SSL server more carefully than the OS, naturally. See this question for more details. I would recommend implementing the CA certificate that you expect to receive in your application, and compare it by bytes with the root of the trust chain.

This is called certificate attaching .

Answer 4

DNSSec is at the OS level. The only thing you can control in your application is the method of connecting to your server. Just use Secure Sockets Layer - SSL in all your messages.