Should I enable DNSSEC in pfSense when using Quad9 and full DNS HiJacking?

shoulders

My Setup

I have full DNS Hijacking enabled on my network so all of the DNS requests are pushed through my pfSense router and then on to Quad9 over TLS using the DNS Resolver

pfsense 2.7.2

My Question

Services --> DNS Resolver --> General Settings --> DNNSEC

Should I enable this option in for my setup?
Does enabling this option just waste CPU cycles?
Does this option do anything more than DNSSEC validation?

Research

DNS Resolver Configuration | Netgate
- This DNSSEC option's description just tells you want DNSSEC does. However I am assuming this enables DNSSEC Validation and perhaps if this is true the option should be renamed and the documentation updated. I would welcome some clarification here
Quad9 FAQ
- Does Quad9 implement DNSSEC?
  - Yes. Quad9 provides DNSSEC validation on our primary resolvers.
  - In addition we validate DNSSEC on our EDNS enabled service.
  - This means that for domains that implement DNSSEC security, the Quad9 system will cryptographically ensure that the response provided matches the intended response of the domain operator. In the event of a cryptographic failure, our system will not return an answer at all. This ensures protection against domain spoofing or other attacks that attempt to provide false data.

My Thoughts

I do not need to enable this option and waste CPU cycles as the results I get from Quad9 will always be valid because if there is an issue with a signed domain it will not return a result (or probably NXDOMAIN).

The DNSSEC validation n all DNS request on pfsense would always be performed on valid domains anyway.

johnpoz

@shoulders no if you forward dnssec makes zero sense - either where you forward is doing it or they are not. You setting it in unbound is going going to cause issue.. Even quad9 themselves tell you that.

https://docs.quad9.net/Quad9_For_Organizations/DNS_Forwarder_Best_Practices/

Disable DNSSEC Validation

Since Quad9 already performs DNSSEC validation, DNSSEC being enabled in the forwarder will cause a duplication of the DNSSEC process, significantly reducing performance and potentially causing false BOGUS responses.

shoulders

@johnpoz thanks for the clarification and information. I will make sure my notes are updated.

shoulders

@johnpoz

Should the DNSSEC option be renamed to DNSSEC Validation

or

Enable DNSSEC Support ----> Enable DNSSEC Validation to be more descriptive?

I can add a issue on redmine if you think this is suitable.