DNSSEC is short for Domain Name System Security Extensions. It is a set of extensions that add extra security to the DNS protocol. This is done by enabling the validation of DNS requests, which is specifically effective against DNS spoofing attacks. DNSSEC provides the DNS records with a digital signature, so the resolver can check if the content is authentic.
DNSSEC is used to secure the domain name system from abuse and man-in-the-middle-attacks such as, for example cache poisoning. DNSSEC ensures the content in DNS with help of cryptographic methods that use electronic signatures. DNSSEC means that the user, doing a DNS lookup, through the validation of signatures, will be able to determine if the information that comes back in response comes from the correct source and if it has been tampered with on the way. It thus becomes difficult to falsify information in DNS that is signed with DNSSEC without it being detected.
Does not stop all scams
For the average person, DNSSEC means a decreased risk for becoming a victim of fraud when, for example, banking or shopping online because it is easier for the user to determine that they are communicating with the right bank or shop and not a fraudster.
It is, however, important to note that DNSSC does not stop all types of fraud. The function is only designed to prevent attacks where the attacker manipulates responses to DNS queries to achieve their goal. There are still many other security flaws and problems on the internet that DNSSEC does not solve, for example, attacks such as distributed denial of service (DDOS).
When it comes to phishing (pages that are similar or identical to the original to trick one into giving passwords and personal data) and pharming (redirection of a DNS query to the wrong computer) and other similar attacks against DNS, DNSSEC gives some protection. DNSSEC does not however protect against attacks on other levels, for example, attacks on IP or network levels.
Not only is DNSSEC a security feature by itself, it also provides a platform for additional features like:
- DKIM (DomainKeys Identified Mail)
- SPF (Sender Policy Framework)
- DMARC (Domain-based Message Authentication, Reporting and Conformance)
- DANE (DNS-based Authentication of Named Entities)
Especially DANE, which is a protocol that allows Transport Layer Security (TLS) certificates to be bound to Domain Name System (DNS) names, is considered a major step forward in security after some certificate authorities (CA) providers have been breached and any CA could issue a certificate for any domain name. This is why we say that the green padlock is required, but not enough. Going forward it’s important to know that all the popular browsers support DNSSEC and most of them support DANE (for some browsers you may need a plug-in), so implementation of this extra security should put a major dent in the possibilities for DNS spoofing.
DNSSEC is only available for TLDs that support DNSSEC. Over 75% of All Top-Level Domains (TLDs) Now Signed With DNSSEC
Alert: For Control Panel Help & Tutorials, click here: Panel Tutorials
