DNS & Domains•8 min read•advanced

DNSSEC: Securing the Domain Name System

Learn how DNSSEC uses cryptographic signatures to prevent DNS spoofing and cache poisoning attacks.

The Vulnerability in Classic DNS

Standard DNS queries are unencrypted and unauthenticated. An attacker in the network path can easily spoof DNS packets, returning malicious IP addresses to redirect traffic to fake phishing pages. This is called DNS cache poisoning.

Cryptographic Validation

DNSSEC (DNS Security Extensions) signs DNS records using public-key cryptography. When a resolver receives a response, it requests the public key corresponding to the signature and verifies that the record came from the authentic domain owner.

Trust Chain Validation

DNSSEC forms a chain of trust. The parent registry (e.g. .com) holds a Delegation Signer (DS) record verifying the key of the child domain (example.com), and the root zone verifies the keys of the TLD registry.

Interactive example

Try it yourself

Apply this article with the Inspect DNSSEC Signatures.

Open the full Inspect DNSSEC Signatures

Applied Engineering

Explore in MemonaIQ Diagnostic Sandbox

Test and inspect these concepts in action using MemonaIQ's browser-based engineering and security tools.

Inspect DNSSEC Signatures

Launch Tool