Good news: for the second time, meissner.IT is listed in the Gold tier of the BSI Hall of Fame as part of the German Federal Office for Information Security’s E-Mail Security Year.
Why Gold?
The BSI awards Gold status to companies that implement DNSSEC. This is not an end in itself: without signed zones there is no DANE, and without DANE, transport encryption between mail servers remains vulnerable. DNSSEC is therefore the foundation for secure e-mail transport according to TR-03108.
Our Setup
As so often, we rely on lean, easy-to-understand components. The foundation is OpenBSD: secure by default, well documented, no surprises.
Our zones pass through three stages:
- Hidden primary: NSD holds the unsigned zones and is not reachable from the outside.
- Signing: A separate signing service takes over the zones, signs them and handles the key rollovers.
- Authoritative name servers: NSD serves the signed zones publicly.
NSD from NLnet Labs thus fills both roles, quickly and reliably.
It is important to us that no zone is published without being checked: automated checks run before and after signing, so a broken zone never makes it onto the internet. As usual, the published zones are monitored by Zabbix.
Conclusion
Separating signing from serving on OpenBSD keeps every component small and easy to follow. We are happy to have earned Gold for the second time.