DNS & domain

What is DNSSEC? Domain Name System Security Extensions explained

DNSSEC cryptographically signs DNS answers, so resolvers detect forged answers from DNS spoofing or cache poisoning. DNSSEC is also a prerequisite for DANE.

How DNSSEC works

The zone is signed with a key; every record set gets a signature (RRSIG), and the public keys are published in the DNSKEY record. So that resolvers trust these keys, the registrar deposits a DS record with a hash of the key at the registry.

This creates a chain of trust from the root zone via the top-level domain (e.g. .de) down to the domain. A validating resolver checks every answer and marks successfully validated answers with the AD flag; forged answers are discarded.

Algorithm 13 (ECDSAP256SHA256) is recommended. SHA-1 based algorithms (5 and 7) are considered outdated.

Example

example.com.  DS      12345 13 2 3f1a…9c2e
example.com.  DNSKEY  257 3 13 mdsswUyr3DPW…

The DS record lives at the registry, DNSKEY and signatures in your own zone.

Common mistakes

After switching providers the old DS record stays at the registry – the domain then no longer resolves for validating resolvers.
Signatures expire because the zone is not re-signed automatically.
Outdated algorithms such as RSASHA1 (5).

How the Domain Trust Check rates DNSSEC

Criterion “DNSSEC” (weight 5 of 5): DS record at the registrar, DNSKEY in the zone, successful validation (AD flag) and a modern signing algorithm.

Standard: RFC 4033, RFC 4034, RFC 4035