DNS Security Extensions (DNSSEC)

Overview

Meaning and boundaries

DNS Security Extensions (DNSSEC) are extensions to the Domain Name System that add digital signatures so validating resolvers can detect forged or altered DNS data. DNSSEC allows a validating resolver to check cryptographic signatures and a chain of trust for DNS records. It helps detect forged responses, but it does not encrypt DNS queries or guarantee that the destination web application is legitimate. Deployment requires correctly signed zones and matching delegation data.

How it works in practice

The control exists to reduce the likelihood and impact of compromise by making assets, identities, software, data, exposures, and control responsibilities visible and governable. DNSSEC authenticates DNS data origin and integrity but does not encrypt queries, prove that a website is trustworthy, or replace transport security. The workflow identifies the protected object and owner, evaluates threats and dependencies, applies preventive and detective safeguards, and routes exceptions or failures to accountable teams. Controls should be tested against realistic misuse, version changes, privileged access, third parties, and recovery conditions. In this context, deployment requires signed zones, protected keys, correct delegation records, rollover planning, monitoring of validation failures and expiry, tested recovery, and coordination with registrars, DNS providers, and dependent services. Records should preserve scope, ownership, configuration or policy version, changes, approvals, test results, alerts, exceptions, incidents, remediation, and verification that the risk was reduced.

Checks and failure points

Broken key rotation, expired signatures, or incorrect DS records can make a valid domain fail resolution for validating users. Monitor signing health and practice recovery before applying DNSSEC to business-critical payment domains.

How it differs from related terms

DNSSEC authenticates DNS records; TLS protects the web connection; neither independently establishes that a payment request’s destination address is correct. Related entries: Certificate Pinning; Phishing.