DNSSEC creates a hierarchical chain of trust from the root DNS zone down to individual domains.
Each level signs the keys of the level below it, creating an unbroken chain of cryptographic validation.
Root ZSK signs TLD DNSKEY
TLD Zone
No Data
Enter domain to see DS records
TLD publishes DS record (hash of domain KSK)
Domain Zone
No Data
Enter domain to see keys
Domain ZSK creates RRSIG for each record
DNS Records
A
192.0.2.1
AAAA
2001:db8::1
MX
mail.example.com
Validation Process
1
Trust Anchor: Resolver has Root KSK (Key ID: 20326) as trusted starting point
2
Root Validation: Verify TLD DNSKEY using Root ZSK signature (RRSIG)
3
TLD Validation: Get DS record from TLD, verify it matches domain KSK hash
4
Domain Validation: Use domain KSK to verify domain ZSK signature
5
Record Validation: Verify DNS record RRSIG using domain ZSK public key
Key Types
- KSK (Key Signing Key): Signs other DNSKEY records
- ZSK (Zone Signing Key): Signs zone data records
- DS (Delegation Signer): Hash of child zone's KSK
Validation Process
- 1. Start with trusted root key
- 2. Validate TLD key using root signature
- 3. Validate domain key using TLD DS record
- 4. Validate DNS records using domain signatures
Security Benefits
- Data Integrity: Ensures DNS responses haven't been tampered with
- Authentication: Verifies the source of DNS data
- Anti-spoofing: Prevents DNS cache poisoning attacks
- Trust Anchor: Establishes cryptographic trust from root to domain
