requiresDNSSECValidation sample over request

Question

JesusMG OP

Created May ’23

Replies 3

Boosts 0

Participants 2

Hi community:

I'm trying to discover how the dnssec api works, but I cannot get a sample that works with it.

Maybe I'm wrong with the requirements; if it is please, clarify it to me.

So what I understood.

All DNS zones (which respond to TLS listed here https://manage.whois.com/kb/answer/2998) have a way to say, hey I'm who I am.

So without any extra configuration, we can use the new API.

Is that right?

So the code that I did, see the next code

let urlSession = URLSession.init(configuration: .ephemeral)
if #available(iOS 16.0, *) {
   urlSession.configuration.requiresDNSSECValidation = true
}

var request = URLRequest(url: URL(string: "https:&#x2F;&#x2F;www.apple.com")!)

if #available(iOS 16.1, *) {
   request.requiresDNSSECValidation = true
}

 cancellable = urlSession
            .dataTaskPublisher(for: request)
            .retryWithDelay(retries: 2, delay: 2, scheduler: DispatchQueue.global(qos: .background))
            .sink(receiveCompletion: { result in
                if case let .failure(error) = result {
                    print("Error \(error)")
                }

            }, receiveValue: { (data: Data, response: URLResponse) in
                print("It Works")

Result:

Task finished with error [-1001] Error Domain=NSURLErrorDomain Code=-1001, UserInfo={_kCFStreamErrorCodeKey=-2102, NSUnderlyingError=0x600003d86130 {Error Domain=kCFErrorDomainCFNetwork Code=-1001 "(null)" UserInfo={_kCFStreamErrorCodeKey=-2102, _kCFStreamErrorDomainKey=4}}, _NSURLErrorFailingURLSessionTaskErrorKey=LocalDataTask &lt;040AB9E7-EFCB-4072-8357-E0149769BB9D>.&lt;2>, _NSURLErrorRelatedURLSessionTaskErrorKey=(```
    "LocalDataTask &lt;040AB9E7-EFCB-4072-8357-E0149769BB9D>.&lt;2>"
),  NSErrorFailingURLStringKey=https:&#x2F;&#x2F;apple.com&#x2F;, NSErrorFailingURLKey=https:&#x2F;&#x2F;apple.com&#x2F;, _kCFStreamErrorDomainKey=4}

The DNS I'm using is 8.8.8.8. Do you know any other DNS server that supports DNSSEC?

If I remove requiresDNSSECValidation from request it works.

Also, it's curious that even failing the receiveCompletion is never called. But if I use the dataTask` with completion it's called with the error.

Thanks for the clarifications.

Boost

Answer 1

Systems Engineer OP

Apple

May ’23

If I remove requiresDNSSECValidation from request it works.

Using requiresDNSSECValidation means that DNSSEC is required for resolution of the hostname on this request. If DNSSEC is not configured for this domain then it would fail and may be the reason you are running into an issue here. I would try using this parameter with a local resolver first that you control just to prove all the pieces are in place.

0

Answer 2

JesusMG OP

Jun ’23

@meaton Any code sample to test it with a well-known domain that has DNSSEC configured?

Thanks in advance.

0

Answer 3

Systems Engineer OP

Apple

Jun ’23

@meaton Any code sample to test it with a well-known domain that has DNSSEC configured?

Unfortunately there is not because that would be outside of the scope of sample code project. I would talk to your server side team about getting one setup on a local network or internal network as a proof of concept.

0