Contents
What security feature is offered by DNSSEC?
DNSSEC was designed to address those risks and provide cryptographic verification through digital signatures that can be used to validate that records delivered in a DNS response came from the authoritative DNS server serving the queried domain name and haven’t been altered en route.
Can DNSSEC protect data confidentiality?
DNSSEC can help organizations protect sensitive data and definitions stored in DNS server: Some examples of data stored in the DNS and protected by DNSSEC: IP addresses. Mail exchange server details. Host information, such as CPU and OS version.
Does DNSSEC use SSL?
There has been quite a bit of talk lately about the best way to secure a domain, mainly centered in two camps: using Secure Socket Layer (SSL), or using DNS Security Extensions (DNSSEC). To facilitate the encryption, the folks running the web site must obtain what’s known as an SSL Certificate.
Why is it important to know about DNSSEC?
DNSSEC has also been used to bootstrap other cyber security systems that publish cryptographic certificates stored in DNS such as Certificate records, SSH fingerprints, IPSec public keys and TLS Trust Anchors. That said, DNSSEC, unlike SSL certificates, do not provide confidentiality of data. DNSSEC responses are authenticated but not encrypted.
When to use DNSSEC recursive or forwarding DNS server?
When a DNSSEC-aware recursive or forwarding DNS server receives a query from a DNS client for a DNSSEC-signed zone, it will request that the authoritative DNS server also send DNSSEC records, and then attempt to validate the DNS response using these records.
Where is the DNSSEC key stored in RRSIG?
DNS resolvers verify the signature with a public key, stored in a DNSKEY record. DNSKEY: Contains the public key that a DNS resolver uses to verify DNSSEC signatures in RRSIG records. DS (delegation signer): Holds the name of a delegated zone and references a DNSKEY record in the sub-delegated zone.
Do you need DNS server to do DNSSEC validation?
Additionally, if the DNS client is DNSSEC-aware, it can be configured to require that the DNS server perform DNSSEC validation. The following figure shows the validation process.