What Is DNSSEC? DNS Security Extensions Explained
· Unified DNS Team · 10 min read
What Is DNSSEC?
DNSSEC (Domain Name System Security Extensions) is a suite of specifications that adds cryptographic authentication to DNS responses. It allows DNS resolvers to verify that the DNS data they receive is authentic and hasn't been tampered with in transit.
The Basics
- DNSSEC adds digital signatures to DNS records
- Signatures are verified using public key cryptography
- Creates a chain of trust from root servers down to your domain
- Protects against DNS spoofing and cache poisoning attacks
- Does NOT encrypt DNS traffic (that's DNS over HTTPS/TLS)
What DNSSEC Protects Against
| Attack | Without DNSSEC | With DNSSEC |
|---|---|---|
| **Cache poisoning** | Attacker injects fake records | Fake records rejected (signature fails) |
| **Man-in-the-middle** | Responses can be modified | Modifications detected |
| **DNS spoofing** | Fake DNS responses accepted | Only signed responses accepted |
What DNSSEC Doesn't Do
- Doesn't encrypt queries or responses — Data is still readable
- Doesn't protect against DDoS — Different protection needed
- Doesn't hide what domains you visit — Use DoH/DoT for that
- Doesn't prevent all attacks — Just DNS-level spoofing
Why DNSSEC Exists
The Problem: DNS Has No Built-in Security
Traditional DNS was designed in the 1980s without authentication:
> User: "What's the IP for bank.com?"
> DNS: "It's 192.0.2.1"
> User: "Okay, I trust you" (connects to 192.0.2.1)
The vulnerability: Anyone in the path can give a fake answer, and the user has no way to verify it.
DNS Cache Poisoning Attack
Without DNSSEC, attackers can inject fake DNS records:
- Attacker sends spoofed DNS responses to resolver
- Resolver caches the fake IP address for bank.com
- Users querying that resolver get the fake IP
- Users connect to attacker's server instead of real bank
- Attacker captures credentials, serves malware, etc.
Real-World Attacks
2008 Kaminsky Bug:
- Discovered critical vulnerability in DNS
- Allowed rapid cache poisoning
- Led to accelerated DNSSEC adoption
2018 Sea Turtle Campaign:
- Nation-state attackers hijacked DNS
- Redirected traffic from government domains
- DNSSEC would have prevented the attack
How DNSSEC Works
The Chain of Trust
DNSSEC creates a cryptographic chain from the root zone down:
| Zone Level | Signs |
|---|---|
| **Root Zone (.)** | .com zone's public key (DS record) |
| **.com Zone** | example.com's public key (DS record) |
| **example.com Zone** | All DNS records for example.com |
| **Result** | Verified DNS Response |
The Signing Process
Zone administrator (you) does:
- Generate key pair (public + private key)
- Sign all DNS records with private key
- Publish public key in DNSKEY record
- Send hash of public key (DS record) to parent zone
Resolver (verifying) does:
- Request DNS record for example.com
- Receive record + signature (RRSIG)
- Request DNSKEY for example.com
- Verify signature using public key
- Verify DNSKEY is authorized by checking DS record at parent
- Continue chain up to trusted root
Simplified Example
Query: A record for www.example.com
Response includes:
| Record | Type | Value |
|---|---|---|
| www.example.com | A | 192.0.2.1 |
| www.example.com | RRSIG | [signature of A record] |
| example.com | DNSKEY | [public key] |
| example.com | RRSIG | [signature of DNSKEY] |
Verification steps:
- Use DNSKEY to verify RRSIG of A record
- Use parent's DS record to verify DNSKEY
- Chain continues to root (pre-trusted)
- Response is AUTHENTICATED
DNSSEC Record Types
DNSKEY Record
Contains the zone's public key used for verification:
example.com. 3600 IN DNSKEY 257 3 13 (
mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjj
dnopqCmL4BEzMKVt3JvqDlhJR8Rf84pHHqNQ
RkRgrpFXzMM= )
| Field | Value | Meaning |
|---|---|---|
| **Flags** | 257 | Key Signing Key (KSK) |
| **Protocol** | 3 | Always 3 |
| **Algorithm** | 13 | ECDSA P-256 |
| **Public Key** | (base64) | The actual public key |
Key types:
- KSK (257) — Signs other keys, referenced by parent's DS record
- ZSK (256) — Signs zone records, rotated more frequently
DS Record
Hash of child zone's DNSKEY, published in parent zone:
; In the .com zone
example.com. 86400 IN DS 12345 13 2 (
49FD46E6C4B45C55D4AC69CBD3CD34AC
1AFE51DE0496571B1582E5E5F3D9E5A8 )
| Field | Value | Meaning |
|---|---|---|
| **Key Tag** | 12345 | Identifier for the DNSKEY |
| **Algorithm** | 13 | DNSSEC algorithm |
| **Digest Type** | 2 | SHA-256 |
| **Digest** | (hex) | Hash of the DNSKEY |
RRSIG Record
Digital signature for a set of records:
www.example.com. 3600 IN RRSIG A 13 3 3600 (
20260315000000 20260301000000 12345 example.com.
FHpFMB3gLgJ8KLrq...signature... )
| Field | Value | Meaning |
|---|---|---|
| **Type Covered** | A | Signs A records |
| **Algorithm** | 13 | ECDSA P-256 |
| **Labels** | 3 | Number of labels in name |
| **Original TTL** | 3600 | TTL when signed |
| **Signature Expiration** | 20260315... | When signature expires |
| **Signature Inception** | 20260301... | When signature became valid |
| **Key Tag** | 12345 | Which key signed this |
| **Signer's Name** | example.com | Zone that signed |
| **Signature** | (base64) | The actual signature |
NSEC/NSEC3 Records
Prove that a record does NOT exist (authenticated denial):
; NSEC: "Nothing exists between alpha.example.com and beta.example.com"
alpha.example.com. 3600 IN NSEC beta.example.com. A RRSIG NSEC
; NSEC3: Same concept but hashed (prevents zone enumeration)
1AVVQN74SG75UKFVF25DGCETHGQ638EK.example.com. NSEC3 1 0 10 AABBCCDD (
75B9554YFHEPG4QG0DP5QH0H8BKPG3H9 A RRSIG )
Implementing DNSSEC
Prerequisites
Before implementing DNSSEC:
- DNS provider must support DNSSEC — Not all do
- Registrar must accept DS records — Required for chain of trust
- Understand the commitment — Key management is ongoing
Implementation Steps
Step 1: Enable DNSSEC at DNS provider
Most providers handle signing automatically:
- Cloudflare: Dashboard → DNS → Enable DNSSEC
- Route 53: Hosted zone → Enable DNSSEC signing
- Azure DNS: DNS zone → DNSSEC
Step 2: Get DS record values
Provider generates and displays:
Key Tag: 12345
Algorithm: 13 (ECDSAP256SHA256)
Digest Type: 2 (SHA-256)
Digest: 49FD46E6C4B45C55D4AC69CBD3CD34AC1AFE51DE...
Step 3: Add DS record at registrar
Submit DS record values to your registrar:
- Namecheap: Advanced DNS → DNSSEC → Add DS Record
- GoDaddy: DNS Management → DNSSEC → Add
- Porkbun: Domain → DNSSEC → Add Record
Step 4: Verify DNSSEC
# Check if DNSSEC is working
dig +dnssec example.com
# Look for "ad" flag (Authenticated Data)
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2
# Use online validators
# - dnsviz.net
# - dnssec-analyzer.verisignlabs.com
Example: Cloudflare DNSSEC Setup
Step 1: Enable in Cloudflare
Dashboard → Select domain → DNS → DNSSEC → Enable
Step 2: Cloudflare displays DS record:
| Field | Value |
|---|---|
| **Key Tag** | 2371 |
| **Algorithm** | 13 (ECDSAP256SHA256) |
| **Digest Type** | 2 (SHA-256) |
| **Digest** | 4E087683391CF2F5A77CD970D9C9F4CC... |
Step 3: Add DS at registrar (e.g., Namecheap):
- Domain List → Manage → Advanced DNS → DNSSEC → Add New DS Record
- Enter values from Cloudflare
- Save
Step 4: Wait and verify (24-48 hours for full propagation)
Pros and Cons
Advantages
Security benefits:
- Prevents DNS cache poisoning
- Prevents DNS spoofing
- Authenticates DNS responses
- Required for some security features (DANE)
Business benefits:
- Some compliance frameworks recommend it
- Demonstrates security commitment
- Increasingly expected for sensitive domains
Disadvantages
Complexity:
- More DNS records to manage
- Key rotation requirements
- More potential failure points
- Troubleshooting is harder
Risks:
- Misconfiguration can break DNS completely
- Expired signatures = domain unreachable
- Not all resolvers validate DNSSEC
Performance:
- Larger DNS responses
- Additional verification time
- More DNS queries (for signature records)
Should You Implement DNSSEC?
Good candidates:
- Financial services
- Healthcare organizations
- Government domains
- Domains using DANE for email security
- Compliance requirements
May not be necessary:
- Simple marketing websites
- Domains with frequent DNS changes
- Organizations without DNSSEC expertise
- Low-risk applications
Best Practices for MSPs
1. Evaluate Before Enabling
Not every client domain needs DNSSEC:
- Assess risk — What's the impact of DNS spoofing?
- Check compliance — Is DNSSEC required?
- Consider complexity — Can you manage it long-term?
2. Use Managed DNSSEC
Let your DNS provider handle key management:
- Cloudflare — Automatic key rotation
- Route 53 — Managed signing
- Azure DNS — Automatic key management
Avoid self-managed DNSSEC unless you have expertise.
3. Test in Staging First
Before enabling on production domains:
- Test on a non-critical domain
- Verify signing works
- Practice adding DS records
- Understand the troubleshooting process
4. Monitor DNSSEC Health
Set up monitoring for:
- Signature expiration warnings
- Validation failures
- DS record sync issues
5. Document DNSSEC Status
Track for each client:
- DNSSEC enabled (yes/no)
- DNS provider handling signing
- DS record location (registrar)
- Key rotation schedule
- Last verification date
6. Have a Rollback Plan
If DNSSEC causes issues:
Quick rollback process:
- Remove DS record from registrar (breaks chain of trust)
- Wait for DS record TTL to expire
- Turn off signing at DNS provider
Note: During rollback, validating resolvers may see failures.
Troubleshooting DNSSEC
Domain Unreachable After Enabling DNSSEC
# Check if DNSSEC is causing the issue
dig +dnssec +cd example.com # +cd bypasses validation
# If this works but normal query doesn't, DNSSEC is the problem
dig example.com # Fails
Common causes:
- DS record not yet at registrar
- DS record mismatch (wrong values)
- Signing not enabled at DNS provider
- Propagation not complete
Signature Expired
# Check signature expiration
dig +dnssec example.com RRSIG
# Look for expiration date in RRSIG record
# If expired, signatures won't validate
Fix: Contact DNS provider — automatic re-signing should occur.
DS Record Mismatch
# Compare DS at registrar vs DNSKEY at DNS provider
dig DS example.com @g.gtld-servers.net # DS at TLD
dig DNSKEY example.com # DNSKEY at your DNS
# They should correspond (DS is hash of DNSKEY)
Fix: Update DS record at registrar with correct values from DNS provider.
Validating Resolvers
Test with validating resolver:
# Google DNS (validates DNSSEC)
dig @8.8.8.8 example.com
# Cloudflare DNS (validates DNSSEC)
dig @1.1.1.1 example.com
If these fail but non-validating resolvers work, DNSSEC is misconfigured.
Online Diagnostic Tools
- DNSViz: dnsviz.net — Visual DNSSEC chain
- Verisign: dnssec-analyzer.verisignlabs.com — Detailed analysis
- DNSSEC Debugger: dnssec-debugger.verisignlabs.com — Step-by-step
Frequently Asked Questions
Does DNSSEC encrypt my DNS traffic?
No. DNSSEC authenticates DNS responses but doesn't encrypt them. For encryption, use DNS over HTTPS (DoH) or DNS over TLS (DoT).
Will DNSSEC break my website?
Not if implemented correctly. However, misconfigurations can cause validating resolvers to reject your DNS, making your domain unreachable.
Is DNSSEC required?
Not generally required, but some compliance frameworks and security standards recommend or require it. Check your specific requirements.
How do I know if DNSSEC is working?
dig +dnssec example.com
# Look for "ad" flag (authenticated data) in response
Or use online validators like dnsviz.net.
What happens if DNSSEC validation fails?
Validating resolvers (like 8.8.8.8, 1.1.1.1) return SERVFAIL and the domain appears unreachable. Non-validating resolvers may still return results.
Can I turn off DNSSEC after enabling?
Yes, but carefully:
- Remove DS record from registrar
- Wait for DS TTL to expire (up to 48 hours)
- Then turn off signing at DNS provider
Removing in the wrong order causes validation failures.
Does my registrar need to support DNSSEC?
Your registrar needs to accept DS records to publish them in the parent zone. Most major registrars support this.
Get Started with Unified DNS
DNSSEC implementation requires careful attention to detail. Unified DNS lets you view, modify, audit, and backup all DNS records including DNSSEC status — with automated backups protecting your configurations and documentation syncing to Hudu.
Unified DNS is live — try it free for a month with code FREETRIAL2026 at billing setup. No commitment. Or request a demo for a walkthrough.