DNSSEC: Digital Signatures for DNS

dns
sicherheit
English

DNSSEC: Digital Signatures for DNS

DNSSEC cryptographically signs DNS answers — resolvers can verify that the answer really comes from the authoritative server and was not tampered with.

The problem without DNSSEC

DNS answers are unencrypted and unverified. Attackers can forge answers (cache poisoning, DNS spoofing) and redirect users to fake servers.

How it works

The zone is signed with a ZSK (Zone Signing Key).
The ZSK is signed with a KSK (Key Signing Key).
The KSK hash is published as a DS record in the parent zone (chain of trust).
Resolvers validate the signature chain up to the root zone.

New record types

RRSIG (signatures), DNSKEY (keys), DS (delegation), NSEC/NSEC3 (proof that a name does not exist).

Practice

Registrars usually enable DNSSEC with one click. Afterwards all records in the zone must be signed — errors lead to SERVFAIL. Check: dig +dnssec example.com (flag ad = authenticated).