DNSSEC Explained: How It Secures Your DNS Lookup

DNSSEC stands for Domain Name Security Extensions, a special DNS protocol that enables you to secure your domain's DNS records. It works by adding a layer of cryptography to the DNS records. Cryptography, as you know, is a technique where key pairs are used to create ciphertext as well as decrypt said text. 

In DNSSEC, private/public key cryptography is the primary method of encryption. A secret private key signs the DNS records, which public keys can decrypt to verify that they are unaltered and originate from the correct source.

As a result, it prevents threats like DNS cache poisoning, spoofing, and malicious redirects.

However, to understand DNSSEC properly, we need to revisit how DNS lookups work.

Quick Refresher: How DNS Works

DNS, as you know, translates domain names like “facebook.com” into their IP addresses. This translation occurs with the help of DNS records. For example, the DNS A record stores the IPv4 address of a domain while the DNS AAAA record stores the IPv6 address.

This translation is necessary because computers cannot understand domain names, and humans struggle with IP addresses. 

With the DNS in place, users can input domain names, which the DNS translates into IP addresses, ensuring that their device can connect to the correct server.

However, this DNS process was not originally designed with security in mind, making it vulnerable to certain types of cyberattacks.

Why Was DNSSEC Introduced?

DNSSEC was introduced to enhance the security of the standard DNS. The original DNS protocol, created in 1983, was not designed with security in mind. The reason for that was a simple oversight. After all, the internet was new, and people were not yet aware of its security implications.

This meant that DNS could be easily exploited. Attackers could intercept DNS queries, inject false IP addresses, and redirect users to malicious websites. Nobody would know because there were no checks to see if anything had been tampered with.

To address this, the Internet Engineering Task Force (IETF) developed DNSSEC as an extension to the existing DNS protocol. After years of testing, DNSSEC was implemented at the root level in 2010 and gradually rolled out across major top-level domains (TLDs) such as .com, .net, and country-specific ones like .se.

How DNSSEC Works?

As we mentioned earlier, DNSSEC utilizes public-key/private-key cryptography to sign DNS data digitally. This ensures that when a user queries a domain, it is not possible to tamper with the DNS response.

Here’s a simplified breakdown of the DNSSEC validation process:

• User Entry: You type a domain into your browser.
• DNS Query Starts: The local resolver checks its cache. If it doesn’t have the answer, it forwards the request to your ISP’s recursive DNS resolver.
• Recursive Lookup: The resolver contacts root servers, TLD servers, and finally the authoritative DNS server for the domain.
• DNSSEC Validation: At each level, the DNS server returns cryptographic signatures (RRSIG records) along with the records' RRSets. An RRset is a collection of all DNS records for a domain that share the same name and type. RRSIGs are for RRsets, not individual records. 

These signatures are verified using DNSKEY records. 

• Trust Chain: The verification process traces a chain of trust from the root zone down to the specific domain, utilizing additional DNSSEC records, such as DS, NSEC, and CDS.

We mentioned some extra records in that breakdown. All of them are part of the DNSSEC records. Let’s check them out in a bit more detail.

DNSSEC Record Types

To implement DNSSEC, several new DNS record types are introduced. They are as follows.

• RRSIG: Contains the cryptographic signature that verifies a DNS record was not tampered with. 
• DNSKEY: Holds the public key used to verify the RRSIG. DNSKEY is required to trust the RRSIG.
• DS (Delegation Signer):  Passes trust from parent to child zones. So, from a TLD zone like “.com” to the child zone like “example.com”, authority is transferred via DS records. DS records are only present in the parent zone that verifies the child zone. They don’t exist in the child zone itself. Read on to learn about the KSK and discover what the DS record actually stores.
• NSEC/NSEC3: Prove that a DNS record does not exist. This ensures that fake DNS records cannot be used.
• CDNSKEY/CDS: Allow child zones to update their DS records in parent zones.

In addition to these records, two types of cryptographic keys are used for the whole system. They are:

• Zone Signing Key (ZSK): Signs zone data.
• Key Signing Key (KSK): Signs the DNSKEY record containing the ZSK. The digest of the KSK is stored in the DS record. 

How Are These Records Used in The DNSSEC Validation Process?

Here’s how they are used in the DNSSEC validation process.

1. Your domain (example.com) enables DNSSEC and generates a Key Signing Key (KSK) and a Zone Signing Key (ZSK). Both keys have a private and a public version. The public versions are stored in the DNSKEY records. Since one record holds one key, multiple DNSKEY records are required to hold all the keys. Together, these form the DNSKEY RRset.
2. The ZSK is used to sign the zone’s resource record sets (A, MX, TXT, etc.), creating RRSIGs for them. The KSK is used to sign the DNSKEY RRset itself, producing another RRSIG(DNSKEY).
3. A DS record, which contains a digest (hash) of the KSK’s DNSKEY record, exists in the parent zone (like .com).
4. Now, when a resolver wants to validate example.com, it:
• Starts at the root zone, goes to .com, and retrieves the DS record for example.com.
• Uses the DS to check that the KSK DNSKEY in your zone is authentic.
• With the KSK trusted, it verifies the RRSIG(DNSKEY), which secures the entire DNSKEY RRset (both KSKs and ZSKs).
• With the ZSK now trusted, it verifies the RRSIGs on your DNS data (A, MX, etc.).

If all these checks succeed, the resolver can be confident the DNS data is authentic and hasn’t been tampered with.

This chain of cryptographic trust is how DNSSEC prevents spoofing and tampering. This hierarchy extends all the way to root domains. And the keys used to verify the root zone’s data are created in a yearly ceremony held by the IANA called the “Key/Root Signing Ceremony.”

Example of DNSSEC-Related Records

1. DS Records:

Here is an example of a DS record.

example.com. 21599 IN DS 31589 8 2 CDE0D742D6998AA554A92D890F8184C698CFAC8A26FA59875A990C03E576343C

• example.com - domain name
• 21599 - TTL (Time To Live)
• DS -record type
• 31589 - Key Tag
• 8 - algorithm used
• 2 - digest type
• Last string - Digest of the DNSKEY

2. DNSKEY Record:

Here is an example of a DNSKEY record.

example.com. 3600 IN DNSKEY 256 3 8 (

 AwEAAc2WzT....9DAUkM= ) ; ZSK

• 256 → Zone Signing Key (ZSK)
• 3 → DNSSEC protocol version
• 8 → RSA/SHA-256 (algorithm)
• The long Base64 string is the public key

3. RRSIG:

Here is an example of an RRSIG.

example.com. 3600 IN RRSIG A 8 2 3600 (

20250808000000 20240708000000 256 example.com.

 fL3aWZ9qxg== )

• Signs the A record for example.com
• Proves that the ZSK signed it from the DNSKEY record
• Signature is validated by the resolver using the DNSKEY

Pros and Cons of DNSSEC

DNSSEC is necessary for the security of the Internet. However, along with its benefits, there are also some drawbacks. However, it is flat-out better to use it if you can. As for its advantages and limitations, let’s check them out.

Benefits:

• Protects users from DNS spoofing and cache poisoning.
• Adds a layer of integrity and authenticity to DNS responses.
• Builds greater trust in internet-based services, especially banking, e-commerce, and email.

Limitations:

• Slight increase in DNS resolution time (~300ms initial delay).
• More complex to configure and maintain.
• Does not protect against DDoS attacks or encrypt DNS data. It only indicates that the data remains unchanged and originates from the correct source.

Should You Enable DNSSEC?

If your domain registrar and hosting provider support DNSSEC, enabling it is highly recommended. It significantly improves DNS security, especially for websites that handle sensitive information.

However, not all TLDs support DNSSEC. You’ll need to check if your domain extension allows for its activation. If it does, enabling DNSSEC is a valuable and straightforward upgrade to your cybersecurity.

Final Thoughts

DNSSEC is a valuable enhancement to the Domain Name System. It provides some much-needed security features to a system that previously had none. 

While it is not a complete solution, it is still necessary, and if your domain allows it, you should enable it. This way, you can protect your visitors from cache poisoning attacks and phishing attempts and create a secure web presence.