DNSSEC: The Complete Guide to DNS Security Extensions

DNSSEC (Domain Name System Security Extensions) is a suite of specifications designed to add security to the DNS protocol. DNSSEC protects internet users from forged DNS data by using public-key cryptography to digitally sign DNS records. When DNSSEC is enabled, DNS resolvers can verify that the DNS response they receive is authentic and has not been tampered with.

The original DNS protocol, designed in the 1980s, had no built-in security mechanism. This made DNS vulnerable to various attacks where malicious actors could redirect users to fake websites. DNSSEC was developed to address these vulnerabilities by adding authentication to DNS responses.

How DNSSEC Works

DNSSEC works by creating a chain of trust from the DNS root zone down to individual domain names. Here's the DNSSEC process:

1. Zone Signing: The domain owner signs their DNS zone with a private key, creating RRSIG (Resource Record Signature) records
2. Key Publication: The public key (DNSKEY) is published in DNS so resolvers can verify signatures
3. Delegation Signer: A DS (Delegation Signer) record is placed in the parent zone, linking the child zone's keys to the parent
4. Validation: DNSSEC-validating resolvers verify each signature up the chain to the root trust anchor

DNSSEC Record Types

DNSSEC introduces several new DNS record types:

• DNSKEY: Contains the public signing key for a zone
• RRSIG: Contains the cryptographic signature for a DNS record set
• DS: Delegation Signer record that links parent and child zones
• NSEC/NSEC3: Provides authenticated denial of existence for non-existent domain names

DNSSEC Prevents Cache Poisoning Attacks

DNS cache poisoning (also known as DNS spoofing) is an attack where malicious DNS data is inserted into a resolver's cache. When users query that resolver, they receive the poisoned data and are directed to attacker-controlled servers. DNSSEC prevents cache poisoning by allowing resolvers to verify the authenticity of DNS responses through cryptographic signatures.

DNSSEC Enables Secure Email Delivery

DNSSEC is a foundational technology for email security mechanisms like DANE (DNS-Based Authentication of Named Entities). With DNSSEC-signed TLSA records, email servers can authenticate TLS certificates directly through DNS, preventing man-in-the-middle attacks on email traffic. DNSSEC + DANE provides a more robust alternative to traditional certificate authorities for email encryption.

DNSSEC Supports Modern Security Standards

Many modern security protocols and technologies rely on DNSSEC for secure DNS lookups:

• DANE (RFC 6698): Uses DNSSEC to bind TLS certificates to DNS names
• DMARC/DKIM/SPF: Email authentication relies on authentic DNS records
• CAA Records: DNSSEC protects Certificate Authority Authorization records from tampering
• SSHFP Records: SSH fingerprints in DNS require DNSSEC for security

DNSSEC Compliance Requirements

DNSSEC is increasingly required by government regulations and industry standards:

• US Government: All .gov domains require DNSSEC
• Financial Services: Many regulatory frameworks recommend DNSSEC
• Healthcare: HIPAA security requirements align with DNSSEC benefits
• European Union: NIS2 directive emphasizes DNS security including DNSSEC

DNSSEC Key Types: KSK and ZSK

DNSSEC uses two types of cryptographic keys to secure DNS zones:

Zone Signing Key (ZSK): The DNSSEC ZSK is used to sign individual DNS records in the zone. The ZSK is rotated more frequently (typically every 1-3 months) because it's used often. ZSK uses shorter key lengths (1024-2048 bits) to keep DNSSEC signatures compact.

Key Signing Key (KSK): The DNSSEC KSK signs only the DNSKEY record set, essentially vouching for the ZSK's authenticity. The KSK is rotated less frequently (annually or less) and uses longer key lengths (2048-4096 bits) for enhanced DNSSEC security. The KSK's hash is published as the DS record in the parent zone.

DNSSEC Algorithms

DNSSEC supports multiple cryptographic algorithms for signing:

• RSA/SHA-256 (Algorithm 8): Widely supported DNSSEC algorithm, recommended for compatibility
• ECDSA P-256 (Algorithm 13): Modern DNSSEC algorithm with smaller key sizes and signatures
• Ed25519 (Algorithm 15): Newest DNSSEC algorithm, highly efficient and secure

Most DNSSEC deployments today use Algorithm 13 (ECDSAP256SHA256) due to its balance of security, efficiency, and broad support among DNSSEC-validating resolvers.

DNSSEC Validation Process

When a DNSSEC-validating resolver receives a DNS response, it performs the following DNSSEC validation steps:

1. Fetch the DNSSEC RRSIG records for the requested data
2. Fetch the DNSSEC DNSKEY records for the zone
3. Verify the DNSSEC RRSIG using the ZSK from the DNSKEY set
4. Verify the ZSK using the KSK (check the DNSSEC self-signature)
5. Fetch the DNSSEC DS record from the parent zone
6. Verify the DS matches the KSK's hash
7. Recursively validate the DNSSEC chain up to the root trust anchor

If any step in the DNSSEC validation process fails, the response is marked as BOGUS and rejected by the resolver.