Email and DNS security
What DNSSEC protects
Understand signed DNS data, the chain of trust, and the important security properties DNSSEC does not provide.
8 minute lesson
DNSSEC adds signatures that let a validating resolver check the origin and integrity of DNS data.
Signed zones publish DNSKEY records and RRSIG signatures over record sets. A validating resolver checks that the signature matches the data and a trusted key. This detects forged or modified answers; it does not hide the records.
Trust crosses a delegation through a DS record in the parent zone. The parent vouches for a key in the child, and the chain continues toward a resolver’s configured root trust anchor.
The resolver can classify a response as:
- secure: signatures validate through a trusted chain
- insecure: the zone is deliberately unsigned, with proof that no DS delegation exists
- bogus: signatures or the chain should validate but do not
A bogus result is normally returned to applications as SERVFAIL. This is a safety feature: the resolver refuses data it cannot authenticate.
Inspect signed response data with:
dig +dnssec A cloudflare.com
dig +dnssec DNSKEY cloudflare.com
dig DS cloudflare.com+dnssec asks to receive DNSSEC records; it does not make dig perform complete validation by itself. An ad flag says the responding recursive resolver considers the answer authenticated. That signal is meaningful only when you trust the path to that resolver.
DNSSEC does not encrypt queries, hide record contents, protect an unsigned zone, keep an authoritative server online, or make a malicious application safe. It authenticates DNS data, not the service reached afterward.
Deployment order matters. Have the DNS host sign and verify the zone before publishing DS data through the registrar. During removal or provider migration, coordinate keys and DS records so the parent never promises a chain the active child cannot satisfy. A stale DS record can make the entire zone fail for validating users while non-validating tests appear healthy.
Your action is to query one signed and one unsigned domain through a validating resolver. Record the RRSIG, DNSKEY, DS, and ad evidence, then explain why an unsigned answer is not automatically bogus.
Lesson completed