So if was your domain name, the TLD is “com” and its nameservers are a., b. DS - Delegation Signer – this record exists in the TLD’s nameservers.RRSIG Exists for each RR and contains the digital signature of a record.DNSKEY Holds the public key which resolvers use to verify.Likewise DNSSEC too requires several RRs. A complete list of DNS RRs can be found here. Some common ones are A record which contains the IP address of the domain, AAAA record which holds the IPv6 information, and MX record which has mail servers of a domain. DNSSEC Resource RecordsĪ Resource Record (RR) contains a specific information about the domain. Now DNSSEC enabled DNS resolvers (like Google Public DNS) can verify the authenticity of a DNS reply (containing an IP address) using the public DNSKEY record. DNSSEC signs all the DNS resource records (A, MX, CNAME etc.) of a zone using PKI (Public Key Infrastructure). DNS Security Extensions (DNSSEC) is a specification which aims at maintaining the data integrity of DNS responses. We all know that DNS is a protocol which resolves domain names to IP addresses, but how do we know the authenticity of the returned IP address? It is possible for an attacker to tamper a DNS response or poison the DNS cache and take users to a malicious site with the legitimate domain name in the address bar.

Plesk license keygen learning