Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

With some people wondering how DNSSEC could affect global censorship, I'd like to know if DNSSEC could protect a zone from being partially modified by a grandparent zone. (The point of this question is not to suggest that ICANN or it's members are not be trusted, but to figure out how DNSSEC affects the power they could exercise in theory.)

For example:

  • ICANN owns the root zone
  • The .de zone is delegated to DENIC, Germany.
  • Assume is delegated to some 3rd party.

Now, assuming DENIC does not remove from their zone, would it be possible for them to redirect the subdomain elsewhere by returning signed records from the .de servers for ?

Similarly, would it be possible for the DNS root to easily return signed fake records of a third-level domain xy.z while the second-level zone z is not participating in this and is not affected otherwise?

share|improve this question
up vote 1 down vote accepted

Your parents always have the ability to mess with your zone. Unfortunately you need to trust them.

Technically, .de would sign a DS record which is a hash of the DNSKEY that is used for signing If .de is doing the right thing and pointing to the correct keys, then no they can't mess with the data. The problem is that .de can also point to their own fabricated keys and their own nameservers for and thus "take it over". They can even query your own servers to mirror all the data but the ones they want to change.

So... Yes, .de can take over and there isn't much to do about it unless you've convinced the clients out there to use's DNSKEY itself as a trust-anchor. Which I suspect some enterprise environments might do (trust their companies key so they don't have to require the upstream to be stable). But generally no one will do this as it's not scalable to maintain a bunch of trust anchors.

As for your grandparent (the root, in your example), in order for them to mess with a grandchild they'd have to take over the parent and publish new keys for them as well. So the root is equally as powerful and can take over everything underneath it, but they must do so by taking over all the children not just the grandchildren or the grandgrandchildren.

share|improve this answer
I knew most of this. The important part of your answer, though, was the third paragraph: the grandparent really would have to take a child zone including all grandparents to modify one grandparent - which in my opinion is at least impractical to do quickly for large zones. Thanks! – jroith Feb 5 '11 at 17:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.