What is DNSSEC?

DNSSEC (Domain Name System Security Extensions) is a set of extensions for DNS that adds cryptographic protection for DNS responses and makes it possible to verify that DNS data is authentic and has not been tampered with.

In simpler terms: DNSSEC protects DNS from response spoofing.

---

#What problem DNSSEC solves

Ordinary DNS:

• does not verify the authenticity of a response
• the client trusts whoever answers first

This allows attacks such as:

• spoofing a site's IP address
• redirecting to a phishing server
• DNS spoofing / cache poisoning attacks

DNSSEC solves exactly this problem.

---

#What DNSSEC actually does

DNSSEC provides two key things:

#1. Authenticity of data

The client can verify:

• that the DNS response came from the real authoritative server
• and not from an attacker

---

#2. Integrity of data

The client makes sure that:

• the DNS record was not altered along the way
• the IP address is really the one the domain owner specified

Important: DNSSEC does not encrypt data, it signs it.

---

#How DNSSEC works (simplified)

1. The DNS zone is signed with a cryptographic key
2. Digital signatures are created for the records
3. The client receives:

• the DNS record
• the signature for it

4. The client verifies the signature via a chain of trust:

• from the domain
• to the zone
• to the DNS root zone

5. If verification succeeds, the response can be trusted

If the signature does not match, the response is discarded.

---

#What DNSSEC does NOT do

This is a favorite interview question:

DNSSEC does not encrypt DNS requests DNSSEC does not hide which domains you are querying DNSSEC does not replace HTTPS

DNSSEC:

• guarantees the correctness of DNS
• but does not protect a site's content

---

#Where DNSSEC is used

DNSSEC:

• is configured at the domain level
• is supported by many registrars
• is used in critical zones (banks, government services)

But:

• deployment is more complex than plain DNS
• so it is not used everywhere

---

#Real-life example

Ordinary DNS is like an address on a piece of paper:

• anyone can alter it

DNSSEC is like an address:

• with a notary's seal
• a forgery is easy to detect

---

#Short interview answer

Remember this formulation:

DNSSEC is a DNS extension that adds a cryptographic signature to DNS records and makes it possible to verify the authenticity and integrity of DNS responses, protecting against their spoofing.