DNSSEC: what it is and why you need it
Do you want to know what DNSSEC is and why it is so important for the security of your website? Domain Name System Security Extensions is one of the most underrated security technologies for the internet. Many website owners do not even know this technology exists, while it plays a crucial role in protecting your visitors. In this in-depth article we explain everything: what it means exactly, how it works technically, and why you should activate it for your domain name today.
What is DNSSEC and how does it protect your website?
DNS Security Extensions is an extension of the existing Domain Name System that adds cryptographic signatures to DNS records. This guarantees that the DNS information you receive is authentic and has not been tampered with along the way by malicious parties. The system acts as a kind of digital seal for the data the DNS system processes.
Without this security, the DNS system is vulnerable to various attacks, such as DNS spoofing and cache poisoning. In these attacks a malicious party can redirect your visitors to a fake website, without the visitor noticing. Think of a phishing page that looks like your bank's login page, but that actually steals your login details.
The need for better DNS security grows every year. Cybercriminals are becoming increasingly sophisticated and DNS attacks happen more often than most people think. By activating DNS Security Extensions, you add an essential layer of protection to your online presence.
How does the DNS system work normally?
To understand why DNS security is needed, we first have to understand how the regular DNS system works. DNS is the phone book of the internet. When you type a domain name into your browser, it is translated into an IP address through the following process:
- Your browser asks your local DNS resolver - What is the IP address of example.nl?
- The resolver asks the root nameserver - Who manages the .nl extension?
- The root points to the .nl nameserver - Ask the .nl TLD server
- The .nl nameserver points to the authoritative nameserver - The nameserver of example.nl is ns1.provider.nl
- The authoritative nameserver gives the answer - The IP address is 93.184.216.34
The problem is that in none of these steps is it verified whether the answer actually comes from the correct server. An attacker can pose as one of these servers and give a fake answer. This is known as DNS spoofing and it is surprisingly easy to carry out on an unprotected network.
The technical workings of DNSSEC explained
DNSSEC solves the validation problem by adding digital signatures to DNS records. It uses asymmetric cryptography with a public and a private key. Here is an overview of the most important components:
| Component | Function | Explanation |
|---|---|---|
| ZSK (Zone Signing Key) | Sign DNS records | Signs individual DNS records within a zone |
| KSK (Key Signing Key) | Sign the ZSK | Signs the Zone Signing Key for extra security |
| DS record | Chain of trust | Connects a zone's key to the parent zone |
| RRSIG record | Signature | The actual digital signature attached to a DNS record |
| NSEC/NSEC3 record | Proof of non-existence | Proves that a requested record does not exist |
The chain of trust
The security system works through a hierarchical chain of trust, similar to the structure of the DNS system itself. Each layer in the hierarchy signs the keys of the layer below it:
- The root zone signs the keys of .nl
- The .nl zone signs the keys of your domain
- Your domain signs the individual DNS records
If an attacker tries to forge a DNS record, the digital signature no longer matches and the fake answer is rejected by the resolver. This makes the system particularly robust against manipulation.
How does validation work in practice?
When a DNS resolver receives an answer with a digital signature, it goes through the following steps to verify authenticity:
- Retrieve the signature - The resolver retrieves the RRSIG record that belongs to the DNS answer
- Request the public key - The resolver requests the public key (DNSKEY) of the zone
- Verify the signature - The public key is used to check whether the signature is valid
- Follow the chain of trust - Through the DS record it is checked whether the key is approved by the parent zone
- Up to the root zone - This process repeats up to the root zone, whose key is universally trusted
Which attacks are prevented?
DNS Security Extensions protects against various types of attacks on the DNS system. These are the main threats that are neutralized:
DNS Cache Poisoning
In cache poisoning an attacker injects fake DNS records into a resolver's cache. As a result all users who use this resolver are redirected to a malicious website. With the digital signatures, fake records are detected because the signature does not match. The resolver rejects the forged answer and thus protects the end user.
Man-in-the-Middle attacks
An attacker intercepts DNS traffic and sends back forged answers. DNSSEC makes this impossible because the attacker does not have the private key to create valid signatures. Every attempt at manipulation is detected immediately.
DNS Hijacking
In DNS hijacking the DNS traffic is redirected to an unauthorized server. The cryptographic validation prevents the forged answers from being accepted by the end user's resolver.
Pharming
Pharming is a variant of phishing in which the attacker manipulates the DNS system to redirect users to fraudulent websites. By activating DNSSEC, this type of attack is effectively blocked because the forged records do not pass validation.
Activating it step by step for your domain
Activating DNS security for your domain name consists of two steps that are carried out with different parties:
Step 1: Activate it with your DNS provider
Your DNS provider (often your hosting party or an external DNS service) has to activate signing for your zone. This generates the necessary cryptographic keys and digital signatures. With most providers this is a simple setting in the control panel.
Step 2: Add a DS record with your registrar
Next you have to add a DS record (Delegation Signer) with the party where your domain name is registered. This DS record links your zone to the parent .nl zone and completes the chain of trust. Without this DS record, the security is not active.
For Dutch domains (.nl)
SIDN, the manager of the .nl domain, has supported DNSSEC since 2012. Many Dutch registrars offer the option to activate it with a few clicks. Internationally, the Netherlands is a frontrunner in the adoption of this security technology.
Checking that everything works correctly
After activation it is important to check that the configuration is correct. Use these tools for a thorough verification:
- DNSViz (dnsviz.net) - Visualizes the complete chain of trust in a clear graph
- Verisign Debugger - Checks the complete chain of trust and reports any problems
- dig command - Use
dig +dnssec example.nlon the command line for detailed technical information - SIDN check tool - Specifically for .nl domains, offers a quick and reliable check
A correct configuration shows green checkmarks at all steps in the chain of trust. If red crosses appear, there is a problem you need to solve before the security is effective.
Difference between DNS security and SSL certificates
Many people confuse this DNS security with SSL certificates. However, they are two completely different security technologies that complement each other and that you both need:
| Property | DNS Security Extensions | SSL/TLS Certificate |
|---|---|---|
| Protects | DNS lookup (name to IP) | Data traffic (browser to server) |
| Type of security | Authentication of DNS data | Encryption + authentication of the connection |
| Visible to the user | No, invisible | Yes, the padlock in the browser |
| Cost | Usually free with your provider | Free to hundreds of euros per year |
| Activation | Through DNS provider and registrar | Through hosting or certificate authority |
You need both security layers for optimal protection. Take a look at our page about SSL certificates for more information about that part of website security.
Frequently asked questions
Does DNS security make my website slower?
The extra DNS records that are added make DNS answers slightly larger, but the effect on load time is negligible. Modern resolvers are optimized for this extra data and cache the results efficiently. In practice your visitors notice nothing of it.
Can the configuration cause problems?
Yes, if the security is configured incorrectly, your domain name can become unreachable for users with validating resolvers. That is why it is important to test the configuration carefully after activation. The most common mistakes are an expired signature or an incorrect DS record with the registrar.
Does every domain name extension support this security?
Most popular extensions support it, including .nl, .com, .net, .org and .eu. Some newer or less common extensions do not yet offer support. Check this with your registrar.
Is it free to activate?
In most cases it is free to activate with your DNS provider and registrar. Some premium DNS services do charge for it, but that is the exception.
The state of affairs in the Netherlands
The Netherlands is one of the leaders in the adoption of DNS security worldwide. A few facts and figures that underline this:
- More than 60% of all .nl domains have the security activated
- SIDN offers excellent support, documentation and tooling
- The government has required it for all .nl government domains since 2018
- Many large ISPs including KPN, Ziggo and T-Mobile validate the signatures in their resolvers
This high adoption rate makes the Netherlands an example for other countries. It shows that broad implementation of DNS security is feasible and valuable for internet safety.
Best practices for management after activation
Once you have activated the security, there are a few best practices to prevent problems and ensure effectiveness:
- Automate key rotation - The cryptographic keys have to be renewed regularly. Automate this process to prevent human error and minimize downtime
- Monitor the status continuously - Set up alerts that warn you if there are problems with signatures or the chain of trust
- Test after every DNS change - After adding or changing DNS records, check whether the security still functions correctly
- Keep a rollback plan ready - Know exactly how you can disable the security if acute problems arise
- Document your configuration - Record which keys, algorithms and settings you use, so that colleagues can also troubleshoot
DNSSEC is an essential security layer that every website owner should activate. It protects your visitors against DNS manipulation, is usually free to activate, and offers an extra layer of trust on top of your SSL certificate. With the increasing cyber threats, the question is not whether you need it, but why you have not activated it yet.
Contact your domain registrar or DNS provider today to activate the security. It is one of the simplest and most effective steps you can take for the safety of your online presence.
DNSSEC: technical workings in detail
To understand how DNSSEC protects your domain, it is useful to grasp the technical workings. DNSSEC adds cryptographic signatures to DNS records, so that the authenticity and integrity of DNS answers can be checked.
The DNSSEC signature process
DNSSEC works with a chain of trust that starts at the root zone and runs up to your domain:
- Zone Signing Key (ZSK) - Signs the individual DNS records in your zone
- Key Signing Key (KSK) - Signs the ZSK and is registered with the parent zone
- DS record - A hash of the KSK that is placed with the parent domain
- RRSIG records - The actual signatures attached to each DNS record
New record types with DNSSEC
| Record type | Function | Where stored |
|---|---|---|
| DNSKEY | Public keys (ZSK and KSK) | In the zone itself |
| RRSIG | Signature attached to each record | In the zone itself |
| DS | Hash of the KSK | With the parent zone |
| NSEC/NSEC3 | Proof that a record does not exist | In the zone itself |
Enabling DNSSEC: step by step
Activating DNSSEC differs per registrar and DNS provider, but the basic process contains these steps:
- Check support - Verify that both your registrar and your DNS provider support DNSSEC
- Activate with your DNS provider - The provider generates the keys and signs your zone
- Add a DS record with the registrar - Copy the DS record from your DNS provider to your registrar
- Test validation - Use tools such as dnsviz.net or verisignlabs.com to check that the chain is correct
Common problems with DNSSEC
Although DNSSEC improves your security, an incorrect configuration can cause problems:
- Expired signatures - RRSIG records have a validity period. If they expire before they are renewed, your domain becomes unreachable for validating resolvers.
- Mismatching DS records - If your DNS provider rotates the keys but the DS record with the registrar is not updated, the chain of trust breaks.
- Problems during a domain transfer - When transferring your domain to another registrar you have to temporarily disable DNSSEC or migrate the DS records carefully.
- Larger DNS answers - DNSSEC signatures increase the size of DNS answers, which can cause problems with some firewalls or resolvers.
Despite these potential challenges, DNSSEC is an important security layer that every domain owner should consider. Most modern registrars and DNS providers make activating DNSSEC increasingly easy.
DNSSEC: the future of DNS security
Although DNSSEC is an important step forward in DNS security, there are also newer developments that shape the future of secure DNS use.
DNS over HTTPS (DoH) and DNS over TLS (DoT) are protocols that encrypt the communication between your device and the DNS resolver. This prevents anyone on the network from seeing which websites you visit. DoH is already supported by default in modern browsers such as Firefox and Chrome. DNSSEC and DoH complement each other: DNSSEC verifies the authenticity of DNS answers, while DoH protects the privacy of DNS requests.
Encrypted Client Hello (ECH) is a related technology that encrypts the last visible information in HTTPS connections. In combination with DNSSEC and DoH it becomes virtually impossible for intermediaries to see which specific websites you visit. This stack of privacy and security technologies is being supported ever more broadly and forms the foundation of a safer internet.
For website owners the practical recommendation is clear: activate DNSSEC with your domain registrar, use a DNS provider that supports DNSSEC, and consider a CDN such as Cloudflare that automatically implements DNSSEC, DoH and other security layers. With this combination you protect both your website and your visitors against DNS-related attacks. Also keep maintaining your other security layers, such as SSL certificates and the configuration of your web hosting environment.
DNSSEC: final advice for domain owners
Activating DNSSEC is an important step in the security of your domain that every website owner should consider. The technology protects your visitors against DNS spoofing and cache poisoning attacks that can redirect them to malicious websites.
Implementation is easier than ever thanks to the growing support at registrars and DNS providers. With many providers, activating DNSSEC is a matter of a single click. The most common pitfall is forgetting to update DS records during a domain transfer, so document your DNSSEC status and include it in your migration checklist. Combine DNSSEC with other security measures such as SSL certificates, strong passwords and regular updates of your website software. No single security measure is sufficient on its own; it is the combination of multiple layers that provides solid security. Periodically check that your DNSSEC configuration functions correctly through online validation tools and keep your keys up to date.
DNSSEC: activate it today
After reading this article you understand what DNSSEC is, how it works and why it is important for the security of your domain. The next step is activation. Log in to your domain registrar and check whether DNSSEC support is available. With most modern registrars, activation is a matter of a few clicks. If you use an external DNS provider, activate DNSSEC there first and then copy the DS record to your registrar. After activation, test whether the chain of trust is correct through dnsviz.net. The whole process takes less than 15 minutes but offers permanent protection against a whole category of DNS attacks. There is no reason to postpone it: activate DNSSEC today and add an important security layer to your online presence.
DNSSEC troubleshooting: solving common problems
When configuring DNSSEC, problems can occur that make your website unreachable if you do not solve them correctly. The most common problem is a mismatch between the DS records at your registrar and the DNSKEY records at your DNS provider. Always check after activation whether the chain of trust is complete through tools such as dnsviz.net or verisignlabs.com. Another common problem is the expiry of RRSIG signatures when your DNS provider has not correctly configured the automatic refresh. This results in SERVFAIL errors for validating resolvers and makes your domain unreachable for a growing part of the internet. When switching DNS provider or registrar, it is crucial to first deactivate the DNSSEC configuration at the old provider before you change the nameservers. Always follow the order: deactivate DNSSEC, wait until the TTL expires, change nameservers, and activate DNSSEC again at the new provider.
