What does DNSSEC protect against, and what does it not do?
Show the answer
Say this first
DNSSEC lets a validating resolver prove an answer came from the zone owner unchanged. Each record set is signed (RRSIG), the zone publishes its public keys (DNSKEY), and the parent vouches for the child's key with a DS record, up to the root's trust anchor. It stops cache poisoning and spoofed answers. It does not encrypt anything, does not hide which names you look up, and does not protect the hop between a non-validating stub and its resolver.
Go deeper
The chain of trust
- The resolver trusts the root key (the trust anchor).
- The root zone signs a DS record for
com., a hash of the .com key. - The .com zone signs a DS record for
example.com.. - example.com signs its records with keys that match that DS.
Zones usually have a key-signing key (KSK, the one the parent's DS points at) and a zone-signing key (ZSK, which signs the records). NSEC or NSEC3 records prove that a name does not exist.
What a validating resolver does
Valid answers get the AD (authenticated data) bit. Answers that fail validation become SERVFAIL. The client gets no answer at all rather than a forged one.
How DNSSEC outages happen
- Signatures expire because the signing job stopped.
- A key rollover without updating the DS at the registrar.
- Moving to a new DNS provider while the old DS stays at the parent.
dig +dnssec shows the RRSIGs, dig +cd turns checking off for a comparison, and delv explains
validation step by step.
They will ask next
A domain returns SERVFAIL from your resolver but works with dig +cd. What is going on?
Validation fails: most likely expired signatures or a DS that no longer matches the zone's key. The domain owner has to fix it. A resolver operator can add a temporary negative trust anchor (RFC 7646) for that domain in the meantime.
What is the difference between NSEC and NSEC3?
NSEC proves a name does not exist by naming the next existing name, which lets anyone walk the whole zone. NSEC3 uses hashed names to make that walk much harder.
If DNSSEC does not encrypt, what does?
DNS over TLS, DNS over HTTPS or DNS over QUIC between the client and its resolver. They protect privacy on that hop; DNSSEC protects the data's integrity from end to end.
Traps
- Saying DNSSEC encrypts DNS.