What is DNSSEC?
DNSSEC cryptographically signs DNS zones so a resolver can verify the authenticity and integrity of answers. We cover RRSIG, DS records and the chain of trust.
Last updated:
DNSSEC (Domain Name System Security Extensions) is a set of extensions to the DNS protocol that add cryptographic signatures to answers, so a resolver can verify that the data comes from the authoritative zone and was not altered in transit. DNSSEC does not encrypt queries or answers. It provides data origin authentication and integrity, protecting against cache poisoning and forged responses. The standard is defined primarily in RFC 4033, RFC 4034 and RFC 4035.
Zone signing and the new records
Deploying DNSSEC starts with signing the zone. The operator generates key pairs and signs every record set (RRset), producing RRSIG signature records, and publishes the public keys in DNSKEY records. In practice two key roles are used: a KSK (Key Signing Key) that signs the DNSKEY records, and a ZSK (Zone Signing Key) that signs the rest of the zone data. This lets the operator roll the zone-signing key without touching the parent zone.
- DNSKEY: holds the zone's public key (KSK or ZSK) used to verify signatures.
- RRSIG: the digital signature over a specific RRset, with validity times (inception and expiration).
- DS (Delegation Signer): a digest of the KSK placed in the parent zone, linking the chain of trust (RFC 4509 recommends SHA-256).
- NSEC/NSEC3: authenticated denial of existence, protecting against forged NXDOMAIN. NSEC3 hinders zone enumeration (RFC 5155).
Chain of trust and the DS record
DNSSEC relies on a chain of trust that runs from the DNS root down the hierarchy. The parent zone does not publish the child's key but a digest of it in a DS record. A validating resolver fetches the DS record from the parent, checks that it matches the child's DNSKEY (KSK), and then uses that key to verify the RRSIG signatures over the data. The process repeats at each delegation, anchored by the root zone key (the trust anchor). If validation fails at any step, the resolver returns a SERVFAIL error instead of the suspect data.
Why deploy DNSSEC
Without DNSSEC a DNS answer can be forged. An attacker on the path or able to poison a resolver's cache can send a user to a bogus IP address. DNSSEC closes that gap with cryptographic verification of data origin and integrity. It is also the foundation for DNS-based mechanisms such as DANE (TLSA records, RFC 6698), which publish certificate information securely. Operational best practices, such as key rollovers, signature validity and submitting the DS record to the registry, are covered in RFC 6781.
DNSSEC and AS202520 SkyPass
DNSSEC operates at the DNS application layer, but its effectiveness depends on the stable, low-latency network connectivity that carries the signed answers. AS202520 SkyPass is an operator with points of presence in Warsaw and Wrocław and peering at Polish internet exchanges (THINX, TPIX, WRIX, 1-IX). It provides the IP transit and BGP peering that keep DNS servers and validating resolvers a short, predictable distance from Polish and European users, which gives fast and reliable DNS responses.
Frequently asked questions
Does DNSSEC encrypt DNS traffic?
No. DNSSEC provides data origin authentication and integrity, not confidentiality. Queries and answers stay in the clear. Transport encryption is handled by separate mechanisms such as DoT (DNS over TLS) and DoH (DNS over HTTPS).
What is the difference between KSK and ZSK?
The KSK (Key Signing Key) signs the DNSKEY records, and its digest is the one placed in the parent's DS record. The ZSK (Zone Signing Key) signs the rest of the zone data. Splitting the roles lets you roll the ZSK without involving the parent zone.
What does SERVFAIL mean with DNSSEC enabled?
A validating resolver returns SERVFAIL when it cannot verify the signatures: for example an expired RRSIG, a missing DS, or a DS that does not match the DNSKEY. The most common cause is a botched key rollover or expired signatures.
What is the DS record for and where is it published?
The DS record is a digest of the child zone's KSK, placed in the parent zone (usually via the registrar or registry). It links the chain of trust. Without a correct DS the child zone is not validated even though it is signed.