DNS & Glossary

DNSSEC (DNS Security Extensions)

Cryptographic signing of DNS so answers can be verified as authentic and untampered — closing the door on cache poisoning and forged DNS responses.

What it is

DNSSEC signs records with a zone's keys (DNSKEY) and links each zone to its parent with a DS record, forming a chain of trust from the root. A validating resolver rejects answers whose signatures do not check out, defeating spoofing and cache poisoning. It provides authenticity, not confidentiality.

Why it matters

  • It prevents attackers from forging DNS answers to redirect users to malicious servers.
  • It underpins DANE/TLSA certificate pinning.

Common mistakes

  • Signing the zone but never uploading the DS to the registrar, so validation never activates.
  • Letting signatures expire or botching key rollover, causing SERVFAIL outages.

How WebInspect checks this

  • The Network Inspector reports whether DNSSEC is enabled and whether the chain of trust validates.