3.1.15. DNSSEC

In standard DNS, the authenticity of the received data is not confirmed in any way. Because of this, there is a risk that when DNS records of a domain are received, the data may be spoofed in the process of transmission by attackers, and visitors will unknowingly end up on the attacker's server instead of the real server with the site. DNSSEC (Domain Name System Security Extensions) is a security extension for DNS that solves this problem.

DNSSEC technology provides two major improvements over standard DNS:

• Data Origin Authtntication. Allows you to make sure that the data is coming from exactly the right zone. For example, whether the records that example.com returns are real example.com records, and if the data is from a cache, whether the data is from the real example.com. For this purpose, DNSSEC builds a chain of trust from the root DNS zone to the DNS records of a particular domain using digital signatures. At each step, you can be sure that the child zone has the trust of the parent zone and that the zone's data has not been compromised.
• Data Integrity Protection. Allows you to verify that the data has not been modified during the delivery process. For example, if there is example.com data, is it the unmodified example.com data that the example.com administrator created? It is important to note that if there is spoofing, DNSSEC does not correct the data, but only indicates that there has been a change.

DNSSEC complements the standard DNS, but does not replace it. That is, either standard DNS (unvalidated data) or standard DNS plus DNSSEC (validated data) can be used to retrieve domain data. In the first case, the data may be spoofed during delivery and remain undetected, while in the second case, the data received via DNS is additionally verified by DNSSEC data and the spoofing will be immediately detected.

Using DNSSEC ensures that site visitors are directed to the correct server and eliminates the possibility of data spoofing and undetected redirection to a malicious server.