dnssdh

dnssdh is a proposed protocol concept intended to enhance the integrity and resilience of the Domain Name System by combining cryptographic hash commitments with distributed storage of DNS data. The name is often described as DNS Security through Shadow Data Hashing, though actual implementations vary and the term is not part of a formal standard. The core idea is to provide verifiable references for DNS records beyond what is offered by DNSSEC alone, by publishing compact, signed hashes of zone data and distributing copies of these hashes and records across multiple trusted nodes.

In typical architecture, a dnssdh system includes an authoritative zone server, resolvers equipped to handle dnssdh proofs, shadow data stores, and a light ledger for cryptographic commitments. The zone authority signs DNS records as usual with DNSSEC and additionally publishes hash commitments for critical records. Resolvers retrieve records and corresponding hashes, verify them against the commitments, and consult shadow stores when needed to validate data integrity and availability.

Operation involves bootstrapping trust via a public-key infrastructure, signing of records, and periodic refreshes of hash commitments. Updates propagate through the normal DNS update mechanism while maintaining consistent shadow data and ledger entries. The approach aims to reduce the risk of undetected tampering, enable offline or partitioned validation, and improve resilience in multi-provider or edge environments.

As of now, dnssdh remains a topic in research and experimental deployments rather than a formal standard. Proponents discuss its potential compatibility with DNSSEC and DNS over HTTPS, while skeptics point to added complexity and performance considerations. See also DNSSEC, DNS over HTTPS, and distributed data verification.