Authenticating DNS responses.
WHAT PROBLEM IT SOLVES
DNS responses can be forged, and there is otherwise no way to detect it.
WHAT IT PROVIDES
Cryptographic proof that a response came from the authoritative source and was not modified.
WHAT IT DOES NOT PROVIDE
Confidentiality. Responses remain readable.
HOW IT WORKS
Records are signed Signatures are published A chain of trust runs from the root through each level to the zone
WHAT THE KEYS ARE
A key signing key, whose fingerprint is published at the parent A zone signing key, used for the records themselves
WHAT THE PARENT PUBLISHES
A delegation signer record, linking to your key.
WHY THAT MATTERS
Without it at the parent, the chain is broken and validation does not occur.
WHAT VALIDATION MEANS
A resolver checking the chain before returning an answer.
WHAT HAPPENS ON FAILURE
The resolver returns a failure rather than the answer.
WHY THAT IS THE RISK
A signing mistake makes the domain unreachable, not merely unverified.
WHAT THAT DEMANDS
Careful key rollover and monitoring.
