DNSSEC: signed DNS answers

In short: Plain DNS is believed without proof. DNSSEC signs the answers so forgeries can be detected. It encrypts nothing; it only proves that the answer is genuine.

The problem

Anyone who slips a false answer to a resolver (cache poisoning, Spoofing) sends you to a foreign site although you typed the right address.

How DNSSEC protects

• Each zone has a key pair (asymmetric encryption). The zone signs its DNS records (digital signature); the signature sits next to them as an RRSIG record.
• The public key is published as DNSKEY in the zone.
• A chain of trust runs from the root (.) via .de to your own domain: the parent zone carries a DS record, the hash of the child zone’s key.
• A validating resolver follows the chain. If something doesn’t match, it returns an error instead of a forgery.

Proving “does not exist”

NSEC/NSEC3 prove with a signature that a name doesn’t exist.

Enabling

1. Turn on DNSSEC at your DNS provider (it signs the zone).
2. Put the shown DS record at your domain registrar.
3. Check with a validation tool. A wrong DS makes the domain unreachable for validating resolvers, so be careful and plan key rollovers.

Limits

No protection against eavesdropping (TLS protects the connection itself), and effective only if the resolver validates.