ICT Stakeholders Push for Implementation of DNSSEC to Protect Nigeria’s .ng Domain Name

Emma Okonji

Stakeholders in Information and Communications Technology (ICT) have stressed the need for the adoption and implementation of the Domain Name System Security Extensions (DNSSEC) in Nigeria in order to protect all websites on .ng domain name, and by extension, the country’s digital ecosystem and to build resilience around it.

The stakeholders also called on the federal government to establish Domain Name System (DNS) in Nigeria as a critical national infrastructure, to enable safe and uncompromised browsing of the internet.

The stakeholders made the call during a webinar organised by the Nigeria Internet Registration Association (NiRA), to commemorate the global Cybersecurity Awareness Month, which holds every October.

DNS is the phonebook of the internet that translates human-readable web addresses like .com, into numerical IP addresses that computers use to interact with each other. It is often described as an internet phonebook that helps users to find their way to websites or online services, while the DNSSEC is a security feature that adds cryptographic digital signatures to DNS records to verify their origin and ensure they have not been tampered with. In other words, it adds a layer of security and trust on DNS by using digital signatures to verify that DNS responses are authentic and have not been tampered with.

In his keynote speech, the President of NiRA, Mr. Adesola Akinsanya, said in an era of Artificial Intelligence (AI), where internet fraudsters use AI to create websites and messages that look real and convincing, which they use in defrauding internet users, the need for the adoption and implementation of DNSSEC for Nigeria became necessary in order to create a resilient digital ecosystem for Nigerians.        

“DNSSEC is an important layer of security, but it must work alongside other protective measures to create a resilient digital ecosystem. The .ng zone is signed, and a significant proportion of Nigerian internet users rely on resolvers that validate DNSSEC signatures. The .ng namespace continues to grow, reflecting increasing adoption of Nigerian digital identity. However, the DNSSEC support among domain registrars remains limited. This creates a gap between the security established at the registry level and its adoption across a wider domain ecosystem,” Akinsanya said.

The Director General, National Information Technology Development Agency (NITDA), Kashifu Inuwa Abdullahi, who was represented by a Senior Manager at NITDA, Olusegun Folayan, said the DNS remained a national infrastructure that borders on government services, and that its value could be diverted or sent to another location completely by internet fraudsters. According to him, when such diversions happen, the DNS goes down and people will not be able to make payments. They will not be able to buy airtime and to refill their data.

“We need to understand that the registry, the registrars, domain name owners, network, and government, must play their roles in protecting Nigeria’s domain name, which is the .ng domain, as well as the digital ecosystem of the country.

We must secure our DNS because it can be attacked and hijacked by fraudsters from either the user device or via the resolver or Internet Service Provider (ISP),” Abdullahi said.

He therefore called for more adoption and implementation of DNSSEC in Nigeria to further protect Nigeria’s domain name and the Nigeria’s digital ecosystem.

A member of the Executive Board of Directors at NiRA, Mr. Ahmad Mukoshy, who presented the technical paper at the webinar, said because the DNS was designed to provide only traffic routing for the internet, it created a security gap for domain name owners and users.

According to him, DNS can actually be used to redirect messages and even to redirect users to fake websites, adding that one of the major security threats for DNS is the caching injections, where users are redirected to websites they never intended to visit.

“So, attackers can actually exploit DNS infrastructure and will put records into your computer resolvers. And these resolvers would directly take you to the website you are visiting. So, for Nigeria, for example, this kind of implication can extend beyond the users. It affects banks, businesses, and the security of the user that is using the website, because our banks and government agencies, educational institutions, all increasingly rely on these online platforms today,” Mukoshy said.

Stressing the need for the implementation of DNSSEC, Mukoshy explained that it would provide additional security to DNS.

“The .ng signed zone is your DNS. It takes the user to the resolver, which then verifies that the user domain name has been signed before it agrees to even take the user to any website. But if any of these keys is broken, automatically trust is breached. In February this year, NiRA took an important step to launch DNSSEC and infrastructure on the Nigerian registry to ensure that DNSSEC is implemented. “This achievement actually established the foundation for the cryptographic encryption of all domain names, DNS communication between the registry and the authoritative name service. The signing has created a milestone for Nigeria because it has put Nigeria on the map of all the registries that have implemented DNSSEC. However, signing the zone is only the beginning because DNSSEC protection is to extend to domain names, and domain owners must also sign their zones,” Mukoshy further said.

“So now our next phase is to make sure that DNSSEC is accessible and manageable and understandable for government institutions, in order to enhance the security of the nation and all websites on .ng domain name,” Mukoshy added.

A panel session that drew experts from across the Nigerian Computer Emergency Response Team (NGCERT), Nigeria Data Protection Commission (NDPC), Nigerian Cybersecurity Coordination Centre (NCCC), the Nigerian Police Force (NPF), and the Nigerian Cyber Police Force National Cyber Security Centre, discussed cybersecurity challenges in the country and the need for the adoption and implementation of DNSSEC in Nigeria.