Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently revising for an exam to do with DNS/DNSSEC.

While I know DNSSEC provides various security enhancements for DNS, I would like to dive a bit deeper(for my own thirst for knowledge!) and would like to know what is still problematic security wise even after DNSSEC is employed? After all it can't have solved all programs DNS was having with regards to security, right?


share|improve this question
up vote 1 down vote accepted

The primary issues that DNSSEC don't solve are:

  1. false data inserted at the master server - if someone hacks your DNS operator they can in theory insert false data that will be signed with your own key.

  2. encryption of DNS queries - the content of the queries and the resulting answers is still clear text on the wire

The former problem is currently unsolved. The latter one is not really seen as a real security issue, since many people willingly allow third parties (Google, OpenDNS, etc) to see their DNS queries anyway.

share|improve this answer
"Cracks your DNS operator" or your registrar or the registry itself, which already happened. – bortzmeyer May 3 '10 at 7:25

It depends in what are your definition of "security". If we use the "CIA triad" -confidentiality, integrity and availability-, DNSSEC only apply (and was designed) for the second one: integrity.

share|improve this answer
DNS done right already has "availability" - DNSSEC doesn't need to solve that. – Alnitak Apr 29 '10 at 14:51

This question really should be, "What DOES DNSSEC do?"

To answer that, DNSSEC is a way to verify that the data you're getting back from the server is legitimate. The records are signed with a private key which can then be verified using the public key published in the record set.

It does not encrypt the records to keep people from seeing them (the whole point of DNS is to distribute that information for public consumption, so this isn't a concern in the vast majority of cases anyway).

It also does not protect against DDoS attacks, reflection attacks, amplification attacks, etc.

You might also refer to RFC 3833, Threat Analysis of the Domain Name System for more information.

share|improve this answer
some of the threats documented in RFC 3833 were addressed by later DNSSEC RFCs. §2.6 and §2.7 (proof of non-existence and wildcards) are fixed by NSEC, for example. – Alnitak Apr 29 '10 at 14:56

The best answer to this is to have a look at DJB's writings on this:

LWN has some good articles too:

And some great answers from this very site:

share|improve this answer
The DJB paper seems completely unrelated. – bortzmeyer May 3 '10 at 7:27
-1 for links to djb rants and troll questions. – Mark Johnson Dec 17 '12 at 3:03

You may find this discussion interesting.

share|improve this answer
.. but irrelevant – Alnitak Apr 29 '10 at 14:50
Not only irrelevant but also quite trollish – bortzmeyer May 3 '10 at 7:28
@bortzmeyer I'd say kookish. – Mark Johnson Dec 17 '12 at 3:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.