DNSSEC
DNSSEC (Domain Name System Security Extensions) is an extension to the Domain Name System (DNS) that enhances its security. DNSSEC provides assurance that the information obtained from the DNS originates from the correct source, is complete, and has not been altered during transmission.
How does DNSSEC work?
DNSSEC is based on the hierarchical digital signing of DNS records using public-key cryptography. A similar principle is used, for example, in digitally signed email.
The Domain Holder generates a pair of private and public keys. The private key is then used to digitally sign the technical data published in the DNS for the domain. The corresponding public key can be used to verify the authenticity of the signature. To make the key publicly available, the Domain Holder publishes it through the parent authority. For domains in the .CZ zone, this authority is the .cz domain registry. The technical data in the DNS are also digitally signed at the .CZ registry level, and the public key used to verify these signatures is in turn provided by the registry operator to the parent authority (the root zone). This creates a chain of trust that ensures the authenticity of the data, provided that none of its links has been compromised and all digital signatures are valid.
The following diagram illustrates a simple example of how an IP address could be forged to redirect a user to a different destination:
Main Components of DNSSEC
Root DNS server
Root servers are a fundamental part of the DNS and the Internet as a whole. They are responsible for directing DNS queries to the appropriate DNS servers for a particular top-level domain. Root servers are authoritative DNS servers located at the very top of the DNS hierarchy.
Authoritative DNS server
An authoritative DNS server stores the official records indicating which IP address is assigned to which domain name. If you are a domain holder, you can either use hosting services or operate your own authoritative DNS server, which will provide accurate information about your domain to other users.
DNS Resolver
A DNS resolver is part of the DNS infrastructure. It is a special type of DNS server responsible for looking up and translating a domain name from a human-readable form (for example, domena.cz) into a numerical IP address that can be more easily processed by computers.
The resolver sends queries to authoritative DNS servers, which return information about the address associated with the requested domain name. This information is then passed back to the browser, which displays the requested website to the user. The resolver may also store IP address information in its temporary memory (cache).
Within DNSSEC, the resolver performs the final validation of digital signatures before the browser displays the requested page. If a signature is invalid (because the chain of trust has been broken) and there is a risk that someone is attempting to provide forged data, the resolver treats the data as untrustworthy and the website will be displayed as unavailable to the user. At present, resolvers are not able to display a specific message indicating that the problem is caused by a signature validation failure and a possible attack.
COURSE: DNSSEC, SECURE DNS
Learn more about DNSSEC technologies through hands-on training courses offered by the CZ.NIC Academy.
Register for a Course
How to check security status?
Domain security
The security status of a domain can be verified using the simple test available in the "Is my domain secure?" section of the DNSSEC information website DNSSEC .
If the domain is not secured, it is advisable to contact the domain registrar or hosting provider to discuss the implementation of DNSSEC.
When choosing a registrar, it is recommended to consider the registrar's certification level. An overview of registrars, including their ratings, is available on the Registrars page.
Internet connection security
You can verify support by taking the test in the “Is my Internet connection secure?” (Czech only) section on the information pages DNSSEC .
If the test shows that the connection is not secure, it is recommended that you contact your Internet service provider to discuss adjusting the settings.
For DNSSEC to function properly and to protect communications from tampering, the resolver used by the Internet service provider must support DNSSEC.
MICROSITE: DNSSEC
Still not sure how DNSSEC works? Our short animated video on the project microsite will guide you through how DNSSEC helps secure DNS.
More about DNSSEC
DNSSEC configuration for advanced users
For users with more advanced technical knowledge, there are several ways to start using DNSSEC. The most common options include using an open resolver, operating your own resolver, or deploying your own authoritative DNS server.
The available solutions differ in both implementation and maintenance requirements. More advanced options typically require greater technical expertise, but they also provide a higher degree of control over the configuration and operation of the DNS infrastructure.
Open DNSSEC Validating Resolvers (ODVR)
Technical information about DNSSEC and its deployment can be found on the CZ.NIC ODVR page. ODVR (Open DNSSEC Validating Resolvers) are publicly available DNS resolvers that can be used instead of the standard DNS resolvers provided by your Internet service provider.
Automated KEYSET management
CZ.NIC implements automated DNSSEC management in accordance with RFC 7344 and RFC 8078 . More information is available on the AKM page.