What is DNSSEC and why does it matter?

DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS records. Without it, attackers can intercept DNS queries and redirect users to malicious servers (DNS spoofing/cache poisoning). DNSSEC ensures the DNS response you receive is authentic.

How does the DNSSEC chain of trust work?

The chain starts at the DNS root servers (trust anchors), passes through the TLD registry (e.g., .com), and ends at your domain. Each level signs the keys of the level below it using DS records. If any link breaks, the entire chain fails.

What is the difference between DNSKEY and DS records?

DNSKEY records contain the actual public keys used to sign DNS records at your domain. DS (Delegation Signer) records are placed at the parent zone (registrar) and contain a hash of your DNSKEY, linking the parent trust chain to your zone.

Should I enable DNSSEC for my domain?

Yes. DNSSEC prevents DNS spoofing and cache poisoning attacks. Most modern registrars support one-click DNSSEC activation. The risk of misconfiguration is low with managed DNS providers like Cloudflare, Route 53, or Google Cloud DNS.

What happens if DNSSEC is misconfigured?

A broken DNSSEC chain (Bogus status) can cause your domain to become completely unreachable for validating resolvers. This is worse than not having DNSSEC at all. Always verify configuration after enabling or during key rollovers.

How do I enable DNSSEC?

For Cloudflare: one-click in DNS settings. For cPanel/BIND: generate keys with dnssec-keygen, sign the zone, then add the DS record at your registrar. For AWS Route 53: enable signing in the hosted zone and add DS at the registrar.

Verificação DNSSEC

Verifique a configuração DNSSEC e cadeia de confiança para qualquer domínio.

O que é DNSSEC?

DNSSEC (DNS Security Extensions) adiciona assinaturas criptográficas aos registros DNS, permitindo que resolvers verifiquem a autenticidade das respostas DNS. Cria uma cadeia de confiança da zona raiz até os domínios individuais.

Como funciona?

O proprietário do domínio assina registros DNS com chaves privadas (KSK e ZSK). Os registros DNSKEY e DS correspondentes criam uma cadeia de confiança. Resolvers verificam assinaturas RRSIG contra DNSKEY publicadas para garantir integridade dos dados.

Ataques mitigados

DNSSEC protege contra envenenamento de cache DNS, spoofing DNS e ataques man-in-the-middle. Garante que as respostas DNS recebidas são autênticas e não foram adulteradas em trânsito.

Tipos de registro principais

DNSKEY: Chaves públicas usadas para assinar registros DNS (KSK para chaves, ZSK para dados da zona)
DS: Hash da DNSKEY, publicado na zona pai para criar cadeia de confiança
RRSIG: Assinaturas criptográficas sobre conjuntos de registros DNS, com datas de início e expiração
NSEC/NSEC3: Prova não-existência de registros (NSEC3 adiciona hashing para prevenir enumeração de zona)

Como Usar Esta Ferramenta

O Que Inserir: Enter a domain to verify its DNSSEC configuration and chain of trust.
O Que Você Obtém: Shows DNSSEC status with security score (0-100), DNSKEY records, DS records, RRSIG validation, chain of trust analysis (Root → TLD → Domain), and algorithm compliance.

Como Interpretar os Resultados

A Secure status means DNS responses are cryptographically authenticated end-to-end. Insecure means DNSSEC is not configured. Bogus indicates broken configuration that may cause resolution failures. Check that DS records at the registrar match the DNSKEY at the authoritative server.

Problemas Comuns e Soluções

Missing DS records at the registrar is the most common issue — DNSSEC is signed but the trust chain is broken. Expired RRSIG signatures cause intermittent failures. Algorithm mismatches between DS and DNSKEY prevent validation. Key rollover failures during migration can break resolution for cached resolvers.

Perguntas Frequentes

DNSSEC Validation Failure DNS Cache Poisoning