📖 What is Domain Name System Security Extensions (DNSSEC)?
Domain Name System Security Extensions (DNSSEC) is a suite of specifications for securing information provided by the DNS. It uses digital signatures and public key cryptography to ensure that the DNS response received by the client is authentic and has not been tampered with.
"Crucial point: DNSSEC provides integrity and authenticity, but it does NOT provide confidentiality; it does not encrypt the DNS query itself."
📚 Certification: Certified Information Systems Security Professional (CISSP)
🔑 What are the Key Concepts of Domain Name System Security Extensions (DNSSEC)?
- ▸ Uses digital signatures (RRSIG) to ensure DNS data integrity, preventing attackers from redirecting users via DNS cache poisoning or spoofing.
- ▸ Establishes a 'Chain of Trust' by linking child zone public keys to parent zone Delegation Signer (DS) records up to the root.
- ▸ Employs DNSKEY records to store public keys, allowing recursive resolvers to verify the authenticity of the signed resource records received.
- ▸ Focuses exclusively on authenticity and integrity; it does not encrypt DNS traffic, meaning queries and responses remain visible in plaintext.
- ▸ Requires recursive resolvers to perform validation, checking signatures against the chain of trust before returning the final result to the client.
🎯 How does Domain Name System Security Extensions (DNSSEC) appear on the CISSP Exam?
You may be asked to identify the best control to prevent DNS cache poisoning attacks. The correct answer will involve implementing DNSSEC to validate the authenticity of DNS responses.
A scenario might describe a need for DNS privacy and encryption. You must distinguish that DNSSEC provides integrity, while DNS over HTTPS (DoH) or TLS (DoT) provides the required confidentiality.
Expect questions where you must analyze a failure in the DNS chain of trust, requiring you to identify missing or mismatched DS records in the parent zone.
❓ Frequently Asked Questions
Why is DNSSEC not considered a complete solution for DNS security?
DNSSEC only guarantees that the data came from the correct source and wasn't changed. It does not provide confidentiality, meaning an attacker can still sniff the DNS traffic to see which domains a user is visiting.
What is the relationship between the DS record and the DNSKEY record?
The DNSKEY record resides in the child zone and contains the public key. The DS record resides in the parent zone and contains a hash of that public key, creating the secure link in the chain of trust.