What is DNSSEC and why does it matter?

DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS records. Without it, attackers can intercept DNS queries and redirect users to malicious servers (DNS spoofing/cache poisoning). DNSSEC ensures the DNS response you receive is authentic.

How does the DNSSEC chain of trust work?

The chain starts at the DNS root servers (trust anchors), passes through the TLD registry (e.g., .com), and ends at your domain. Each level signs the keys of the level below it using DS records. If any link breaks, the entire chain fails.

What is the difference between DNSKEY and DS records?

DNSKEY records contain the actual public keys used to sign DNS records at your domain. DS (Delegation Signer) records are placed at the parent zone (registrar) and contain a hash of your DNSKEY, linking the parent trust chain to your zone.

Should I enable DNSSEC for my domain?

Yes. DNSSEC prevents DNS spoofing and cache poisoning attacks. Most modern registrars support one-click DNSSEC activation. The risk of misconfiguration is low with managed DNS providers like Cloudflare, Route 53, or Google Cloud DNS.

What happens if DNSSEC is misconfigured?

A broken DNSSEC chain (Bogus status) can cause your domain to become completely unreachable for validating resolvers. This is worse than not having DNSSEC at all. Always verify configuration after enabling or during key rollovers.

How do I enable DNSSEC?

For Cloudflare: one-click in DNS settings. For cPanel/BIND: generate keys with dnssec-keygen, sign the zone, then add the DS record at your registrar. For AWS Route 53: enable signing in the hosted zone and add DS at the registrar.

Verificación DNSSEC

Verifica la configuración DNSSEC y cadena de confianza para cualquier dominio.

¿Qué es DNSSEC?

DNSSEC (DNS Security Extensions) agrega firmas criptográficas a los registros DNS, permitiendo que los resolvers verifiquen la autenticidad de las respuestas DNS. Crea una cadena de confianza desde la zona raíz hasta los dominios individuales.

¿Cómo funciona?

El propietario del dominio firma registros DNS con claves privadas (KSK y ZSK). Los registros DNSKEY y DS correspondientes crean una cadena de confianza. Los resolvers verifican firmas RRSIG contra DNSKEY publicadas para garantizar la integridad de los datos.

Ataques mitigados

DNSSEC protege contra envenenamiento de caché DNS, spoofing DNS y ataques man-in-the-middle. Garantiza que las respuestas DNS recibidas son auténticas y no fueron adulteradas en tránsito.

Tipos de registro principales

DNSKEY: Claves públicas usadas para firmar registros DNS (KSK para claves, ZSK para datos de zona)
DS: Hash de la DNSKEY, publicado en la zona padre para crear cadena de confianza
RRSIG: Firmas criptográficas sobre conjuntos de registros DNS, con fechas de inicio y expiración
NSEC/NSEC3: Prueba la no-existencia de registros (NSEC3 agrega hashing para prevenir enumeración de zona)

Cómo Usar Esta Herramienta

Qué Ingresar: Enter a domain to verify its DNSSEC configuration and chain of trust.
Qué Obtienes: Shows DNSSEC status with security score (0-100), DNSKEY records, DS records, RRSIG validation, chain of trust analysis (Root → TLD → Domain), and algorithm compliance.

Cómo Interpretar los Resultados

A Secure status means DNS responses are cryptographically authenticated end-to-end. Insecure means DNSSEC is not configured. Bogus indicates broken configuration that may cause resolution failures. Check that DS records at the registrar match the DNSKEY at the authoritative server.

Problemas Comunes y Soluciones

Missing DS records at the registrar is the most common issue — DNSSEC is signed but the trust chain is broken. Expired RRSIG signatures cause intermittent failures. Algorithm mismatches between DS and DNSKEY prevent validation. Key rollover failures during migration can break resolution for cached resolvers.

Preguntas Frecuentes

DNSSEC Validation Failure DNS Cache Poisoning