How can you be sure that the website you're looking at really is the one whose address you typed? The answer: by using DNSSEC – a protocol for increasing the security of the system that computers and mobiles use to translate domain names into IP addresses. If your internet service provider doesn’t yet support DNSSEC, you can now enable safer surfing yourself by getting a Valibox.
What is DNSSEC and does my ISP support it?
When you type a website address, your computer or mobile gets it translated into an IP address using the Domain Name System (DNS). With DNSSEC, the translation has a digital 'signature' added. So your device can tell that it's genuine, not a fake intended to misdirect you to a fraudulent website. However, you're safer with DNSSEC only if your device can actually check the signatures ('validation' in tech jargon). Although SIDN has been encouraging everyone to use DNSSEC for years, not all internet service providers (ISPs) have enabled validation for their customers. At internet.nl you can check if your provider offers DNSSEC validation. If your ISP doesn't offer validation, you can now get a Valibox: your own personal DNSSEC validation device.
What is the Valibox?
The Valibox is an open-source safer surfing solution developed by SIDN Labs. It's an easy-to-use home router that checks the signatures on domain name translations. The software is based on OpenWRT and Unbound.
How does it work?
You can add a Valibox to an existing network. You'll then have wi-fi access to your network, with added DNSSEC validation. As well as providing normal DNSSEC support, the Valibox provides a workaround for DNSSEC errors. When an error is detected, you get a message, giving you the option of temporarily or permanently disregarding the fact that the signature isn't right. Read more about how the Valibox works and how you install it.
Why are we encouraging everyone to use DNSSEC?
SIDN encourages everyone – both ISPs and their customers – to use DNSSEC. One of the reasons that some ISPs are reluctant to enable validation is that, if the manager of a domain name makes a mistake (e.g. they forget to update their signatures on time), people who rely on validation won't be able to reach the domain in question. That's because the system often can't tell the difference between a translation with a signature that's wrong due to an honest mistake, and a translation from an unreliable source. Meanwhile, people who haven't got validation enabled will be able to reach the domain as normal.
Although DNSSEC errors aren't very common, it can be frustrating if you can't reach a website because of a technical hitch. That's one of the reasons that not everyone is keen to support validation.
We've launched the Valibox so that you can decide for yourself whether you want the protection provided by validation, even if your ISP doesn't support it. You can choose whether the Valibox should temporarily ignore certain errors.
More information and set-up guide
Visit valibox.sidnlabs.nl for a detailed explanation of the Valibox and a step-by-step set-up guide.