DNSSEC

What it is

DNS was designed without authentication: a resolver cannot tell a forged answer from a real one. DNSSEC adds digital signatures (RRSIG records) to every record set in a zone.

Validating resolvers follow a chain of trust from the root zone, through the TLD, down to your zone, using DS records published at the parent and DNSKEY records in your zone.

How it works

• Your zone publishes DNSKEY records: usually a Key Signing Key (KSK, flags 257) and a Zone Signing Key (ZSK, flags 256).
• Each record set is signed and gets an RRSIG with an expiry date; signatures must be refreshed before they expire.
• The parent zone (your registrar/TLD) publishes a DS record: a hash of your KSK. This links your zone into the chain of trust.
• Modern algorithms are 13 (ECDSA P-256 SHA-256) and 15 (Ed25519). Algorithms 5/7 (RSA-SHA1) are deprecated.

Examples

370 13 2 BE74359954660069D5C63D200C39F5603827D7DD02B56F120EE9F3A86764247C

257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ==

Common mistakes

• DS record at parent but zone not signed

  This makes the whole domain fail to resolve on validating resolvers. Remove the DS first when turning DNSSEC off.

• Expired signatures

  If the signer stops running, RRSIGs expire and the domain becomes unreachable.

• DS mismatch after key rollover or provider move

  Update the DS at the registrar when the KSK changes.

• Weak algorithms

  Migrate away from RSA/SHA-1 (algorithms 5 and 7).

Specifications

• RFC 4033