Home > Glossary > Certified Information Systems Security Professional > Domain Name System Security Extensions (DNSSEC)

📖 What is Domain Name System Security Extensions (DNSSEC)?

Domain Name System Security Extensions (DNSSEC) is a suite of specifications for securing information provided by the DNS. It uses digital signatures and public key cryptography to ensure that the DNS response received by the client is authentic and has not been tampered with.

🥋 Sensei Says:

"Crucial point: DNSSEC provides integrity and authenticity, but it does NOT provide confidentiality; it does not encrypt the DNS query itself."

📚 Certification: Certified Information Systems Security Professional (CISSP)

🔑 What are the Key Concepts of Domain Name System Security Extensions (DNSSEC)?

▸ Uses digital signatures (RRSIG) to ensure DNS data integrity, preventing attackers from redirecting users via DNS cache poisoning or spoofing.
▸ Establishes a 'Chain of Trust' by linking child zone public keys to parent zone Delegation Signer (DS) records up to the root.
▸ Employs DNSKEY records to store public keys, allowing recursive resolvers to verify the authenticity of the signed resource records received.
▸ Focuses exclusively on authenticity and integrity; it does not encrypt DNS traffic, meaning queries and responses remain visible in plaintext.
▸ Requires recursive resolvers to perform validation, checking signatures against the chain of trust before returning the final result to the client.

🎯 How does Domain Name System Security Extensions (DNSSEC) appear on the CISSP Exam?

You may be asked to identify the best control to prevent DNS cache poisoning attacks. The correct answer will involve implementing DNSSEC to validate the authenticity of DNS responses.

A scenario might describe a need for DNS privacy and encryption. You must distinguish that DNSSEC provides integrity, while DNS over HTTPS (DoH) or TLS (DoT) provides the required confidentiality.

Expect questions where you must analyze a failure in the DNS chain of trust, requiring you to identify missing or mismatched DS records in the parent zone.

❓ Frequently Asked Questions

Why is DNSSEC not considered a complete solution for DNS security?

DNSSEC only guarantees that the data came from the correct source and wasn't changed. It does not provide confidentiality, meaning an attacker can still sniff the DNS traffic to see which domains a user is visiting.

What is the relationship between the DS record and the DNSKEY record?

The DNSKEY record resides in the child zone and contains the public key. The DS record resides in the parent zone and contains a hash of that public key, creating the secure link in the chain of trust.

Related Terms from Certified Information Systems Security Professional

Due Care Asymmetric Encryption Risk Transfer Intrusion Prevention System (IPS) Social Engineering Salt (Cryptography)

📝 Related Study Guides

Study Guide 10 min read

How to Pass the CISSP Exam: A Realistic 2026 Study Plan

To pass the CISSP, you must transition from a technical mindset to a managerial one, focusing on risk management and policy over implementation. Success requires a 3-6 month study plan covering all eight domains, using adaptive practice exams to identify gaps and mastering the "mile wide, inch deep" breadth of the CBK.

Career Guide 10 min read

CISSP Experience Requirements: How to Get Your Waiver in 2026

To earn the CISSP, you need five years of cumulative, paid work experience in two or more of the eight CISSP domains. You can obtain a one-year waiver through a four-year college degree or approved professional certifications. Those lacking full experience can become an Associate of ISC2 after passing the exam.

Deep Dive 8 min read

Kerberos Authentication Explained for the CISSP Exam

Kerberos is a ticket-based authentication protocol designed to provide strong authentication for client/server applications by using secret-key cryptography. It utilizes a trusted third party called the Key Distribution Center (KDC) to issue tickets, enabling Single Sign-On (SSO) and preventing replay attacks through the use of synchronized timestamps.