dnssec

DNSSEC, short for Domain Name System Security Extensions, is a set of specifications that adds cryptographic authentication to DNS data. Its primary goal is to ensure that DNS responses are authentic and have not been tampered with, thereby mitigating risks such as cache poisoning and spoofing.

How it works: DNSSEC uses public-key cryptography to sign zone data. Each signed zone publishes a set of records, including DNSKEY (public keys) and RRSIG (digital signatures for resource records). A parent zone holds a DS (delegation signer) record that links the child zone’s keys to the overall chain of trust. Resolvers that trust a defined root or other anchors validate signatures against known keys. If validation succeeds, the answer is trusted; if not, the resolver may treat the response as bogus. To prove the nonexistence of a name or record, DNSSEC can use NSEC or NSEC3 records. The system creates a chain of trust from a trusted root down through the hierarchy.

Deployment and operation: Zones must be signed, and parent zones must publish DS records to maintain the chain of trust. Operators manage two types of keys: a key signing key (KSK) and a zone signing key (ZSK). Key rollovers require careful coordination to keep the chain intact. Validation is performed by resolvers that have a trust anchor, typically the root zone’s DNSKEY.

Benefits and limitations: DNSSEC provides data integrity and authentication for DNS data but does not provide confidentiality or encryption of the user’s connection. It reduces risk of forged responses but does not prevent phishing or other user-facing attacks. Full benefits require widespread signing of zones and proper key management; misconfigurations can disrupt resolution.

History and standards: DNSSEC materialized through RFCs 4033, 4034, and 4035, with gradual root and zone signing beginning in the 2010s. Adoption varies by domain and resolver support.