DNS Security Extensions (DNSSEC)

Overview

DNS Security Extensions (DNSSEC) are extensions to the Domain Name System that add digital signatures so validating resolvers can detect forged or altered DNS data. The control exists to reduce the likelihood and impact of compromise by making assets, identities, software, data, exposures, and control responsibilities visible and governable. DNSSEC authenticates DNS data origin and integrity but does not encrypt queries, prove that a website is trustworthy, or replace transport security. It should be interpreted alongside Certificate Pinning because the concepts can affect the same decision without representing the same control, event, or risk.

The workflow identifies the protected object and owner, evaluates threats and dependencies, applies preventive and detective safeguards, and routes exceptions or failures to accountable teams. Controls should be tested against realistic misuse, version changes, privileged access, third parties, and recovery conditions. In this context, deployment requires signed zones, protected keys, correct delegation records, rollover planning, monitoring of validation failures and expiry, tested recovery, and coordination with registrars, DNS providers, and dependent services.

It should connect the term to Certificate Management where that relationship changes access, transaction treatment, investigation, communication, or recovery.

Records should preserve scope, ownership, configuration or policy version, changes, approvals, test results, alerts, exceptions, incidents, remediation, and verification that the risk was reduced. Evidence must be protected from alteration and retained according to legal and operational need.

Useful measures include coverage, control effectiveness, unresolved critical findings, remediation age, unauthorized changes, detection time, incident frequency, repeat weaknesses, exception volume, and recovery performance.

The relationship with Phishing should be documented where it affects residual risk or control ownership.