What is DNS Security (DNSSEC)?

DNSSEC is an addition to the Domain Name System (DNS) protocols; it is designed to add security to the DNS to protect it from certain attacks, such as any data modification attack (e.g. cache poisoning). It is a set of extensions to DNS, which provide origin authentication of DNS data, data integrity and authenticated denial of existence.

What are some of the benefits of DNSSEC?

DNSSEC zones prevent man-in-the-middle attacks. Any customer with a DNSSEC-aware resolver will not be at risk from this attack.

DNSSEC is backwards compatible with the existing DNS infrastructure. Customers that are not using DNSSEC will not see any adverse effect. While they won't get the protection, they'll continue to access domain names just as they always have.

DNSSEC is the foundation of providing the safe and secure Internet of the future, including secure web browsing and adding additional security services to a wide variety of Internet services (e.g., email, voice-over-IP, etc.).

The DNS is a critical Internet infrastructure protocol and virtually everything that users do on the Internet depends on it. Protecting the DNS to ensure that users are connecting with the services they expect to be communicating with is the foundation of a safe and secure Internet.

How does DNSSEC protect against this attack?

Each piece of a domain's DNS information has a digital signature attached to it. When a user enters the domain in a browser, the resolver, using keys in a similar manner to TLS/SSL, verifies the signature. If it does not match, the resolver discards the response and waits for another.

DNSSEC ensures that the information in the response you receive is the same information the registrant of the domain name wants you to receive. When a registrant registers a domain name on the Internet, they will also be able to have the domain name secured via DNSSEC. By sending in additional information to their registrar, registrants can “sign” a domain name, thus ensuring that all DNS responses are digitally signed via DNSSEC. By checking the digital signature, a DNS resolver is able to check if the information is identical (correct and complete) to the information the registrant wants you to receive.

What does DNSSEC protect against?

DNSSEC is designed to protect Internet resolvers (clients) from forged DNS data, such as that created by DNS cache poisoning. Currently, a DNS resolver sends a query out to the Internet and then accepts the first response it receives, without question. If a malicious system were to send back an incorrect response, the resolver would use this address until its cache expired. This is bad enough if it's a single user's computer that gets this bad data, it's much worse if it's another name server that answers queries for an ISP – affecting thousands of users.

NameMart supports DNSSEC for your domain, please see the guide https://www.namemart.com/support/help-details?id=2418.