Network Security
DNSSEC
Also known as: DNS Security Extensions
Definition
A set of DNS extensions that cryptographically sign zone data so resolvers can verify the authenticity and integrity of DNS responses.
Examples
- A validating resolver rejects a forged response for bank.example because the RRSIG does not verify against the published DNSKEY.
- A registry rolls its ZSK and publishes new DS records at the parent to maintain the chain of trust.
Related terms
DNS Spoofing
An attack that injects falsified DNS responses to redirect victims from a legitimate domain to an attacker-controlled IP address.
DNS Cache Poisoning
An attack that inserts forged records into a DNS resolver's cache so subsequent queries return attacker-chosen addresses until the TTL expires.
DNS over HTTPS (DoH)
A protocol that carries DNS queries and responses over an encrypted HTTPS connection, protecting them from eavesdropping and tampering on the local network.
DNS over TLS (DoT)
DNS over TLS (DoT) — definition coming soon.
Public Key Infrastructure (PKI)
The combined system of policies, software, hardware and trusted authorities used to issue, distribute, validate and revoke digital certificates that bind identities to public keys.
Digital Signature
A public-key cryptographic mechanism that proves the authenticity, integrity and non-repudiation of a message or document.