DNSSEC Explained

DNS Security Extensions (DNSSEC) is a set of extensions to the Domain Name System (DNS) that allows DNS responses to be cryptographically verified.

DNSSEC helps ensure that DNS records have not been modified or forged while they travel across the Internet.

DNSSEC provides:

• Data authenticity
• Data integrity
• Protection against DNS spoofing and cache poisoning

DNSSEC does not provide encryption or privacy.

Traditional DNS was designed without security.

An attacker may attempt to convince a recursive resolver that a fake IP address belongs to a domain.

Example:

Attacker

example.com
        │
        ▼

203.0.113.200  (Fake)

instead of

93.184.216.34

If the resolver accepts the forged response, users may be redirected to a malicious website.

DNSSEC prevents this by allowing DNS responses to be digitally signed.

Each DNS zone has a pair of cryptographic keys.

• Private Key
• Public Key

The authoritative DNS server signs its DNS records using the private key.

Resolvers verify the signatures using the corresponding public key.

Authoritative Server

DNS Record
      │
      ▼
Digital Signature
      │
      ▼
Recursive Resolver
      │
Verify Signature
      │
      ▼
Trusted Answer

If verification fails, the resolver rejects the response.

DNSSEC works through a chain of trust.

Each level of the DNS hierarchy signs the next level.

Root Zone
     │
     ▼
.com
     │
     ▼
example.com

The root zone is the trust anchor for the entire DNSSEC system.

If every signature is valid, the resolver can trust the final DNS record.

DNSSEC introduces several additional DNS record types.

When a resolver receives a DNS response, it performs validation.

Steps:

1. Retrieve the requested DNS record.
2. Retrieve its RRSIG record.
3. Retrieve the DNSKEY.
4. Verify the signature.
5. Verify the chain of trust up to the root zone.

If validation succeeds, the response is accepted.

Otherwise the resolver returns an error.

A common misconception is that DNSSEC encrypts DNS traffic.

It does not.

DNSSEC provides:

• Authentication
• Integrity

It does not provide:

• Confidentiality
• Privacy
• Encryption

DNS queries remain visible on the network.

For encrypted DNS, technologies such as DNS over HTTPS (DoH) and DNS over TLS (DoT) are used.

DNSSEC and DoH solve different security problems and are often used together.

DNSSEC provides:

• Protection against cache poisoning
• Protection against forged DNS responses
• Verification that DNS records originate from the authoritative server
• Increased trust in DNS infrastructure

DNSSEC does not:

• Hide DNS queries.
• Encrypt DNS traffic.
• Prevent DDoS attacks.
• Protect websites against compromise.

It only verifies the authenticity of DNS data.

A domain usually supports DNSSEC if:

• A DS record exists in the parent zone.
• The zone publishes DNSKEY records.
• DNS responses contain RRSIG records.

Example:

example.com

DNSKEY
RRSIG
DS

Telenegar DNS Check can help determine whether a domain supports DNSSEC by:

• Querying DNSSEC-related record types.
• Displaying DNSKEY records.
• Displaying DS records.
• Displaying RRSIG records.
• Indicating whether DNSSEC appears to be enabled.

Future versions may also perform DNSSEC validation.

• DNSSEC encrypts DNS traffic.
  • False. DNSSEC only authenticates DNS data.

• DNSSEC prevents every DNS attack.
  • False. It prevents forged DNS responses but not every attack.

• DoH replaces DNSSEC.
  • False. DNSSEC and DoH provide different security properties.

• DNS Explained
• Recursive vs Authoritative DNS
• DNS Propagation
• DNS Check

dns dnssec dnskey ds rrsig nsec doh dot security