What is DNSSEC and How Does It Ensure DNS Security - 面试题

DNSSEC (DNS Security Extensions) are security extensions for DNS that ensure data integrity and authenticity through digital signature mechanisms, preventing DNS spoofing, cache poisoning, and other attacks.

Why DNSSEC is Needed

Security Issues with Traditional DNS

shell
User queries www.bank.com
         ↓
    DNS query (plaintext)
         ↓
Attacker forges response
         ↓
User visits phishing site

Major Threats:

DNS cache poisoning
Man-in-the-middle attacks
DNS spoofing

DNSSEC Solution

shell
User queries www.bank.com
         ↓
    DNS query (with signature verification)
         ↓
Verify digital signature
         ↓
Signature verification fails → Reject forged response
Signature verification passes → Return correct IP

How DNSSEC Works

Key System

DNSSEC uses asymmetric encryption to establish a trust chain:

shell
Root Key
    ↓ Signs
TLD Key
    ↓ Signs
Domain Key
    ↓ Signs
DNS Records

DNSSEC Record Types

Record Type	Purpose
DNSKEY	Stores public keys
DS	Delegation Signer, stores hash of child domain's public key in parent domain
RRSIG	Resource record signature
NSEC	Proof of non-existence (proves a record doesn't exist)
NSEC3	Improved version of NSEC, prevents zone enumeration attacks

DNSSEC Verification Flow

shell
1. User queries www.example.com + DNSKEY
         ↓
2. Returns A record and RRSIG signature
         ↓
3. Get DNSKEY public key
         ↓
4. Verify RRSIG signature
         ↓
5. Verify DNSKEY's DS record (from parent domain)
         ↓
6. Verify up trust chain to root key
         ↓
7. All signatures verified → Accept response

DNSSEC Records in Detail

DNSKEY Record

dns
; Stores public key
example.com.    3600    IN    DNSKEY    256 3 8 (
    AwEAAbX8qU... )  ; Base64 encoded public key

Field Descriptions:

Flags: 256 indicates Zone Signing Key (ZSK), 257 indicates Key Signing Key (KSK)
Protocol: 3 indicates DNSSEC
Algorithm: 8 indicates RSA/SHA256

RRSIG Record

dns
; Resource record signature
www.example.com.    3600    IN    RRSIG    A 8 3 3600 (
    20240101000000 20240108000000 12345 example.com.
    oKx8j3... )  ; Base64 encoded signature

Field Descriptions:

Type Covered: Record type being signed (A, AAAA, etc.)
Algorithm: Encryption algorithm
Signature Expiration: Signature expiration time
Signature Inception: Signature inception time
Key Tag: DNSKEY identifier
Signer's Name: Signer's domain name
Signature: Digital signature

DS Record

dns
; Stored in parent domain, contains hash of child domain's DNSKEY
example.com.    3600    IN    DS    12345 8 2 (
    2BB183AF5F22588179A53B0A98631FAD1A2DD3475 )

Purpose: Establish trust chain between parent and child domains

NSEC/NSEC3 Records

dns
; Proves a record doesn't exist
www.example.com.    3600    IN    NSEC    a.example.com. A AAAA

; NSEC3 provides better privacy protection

Purpose:

Prove a domain name doesn't exist
Prevent DNS spoofing

DNSSEC Trust Chain

Trust Anchor

shell
Trust Anchor (Root Key)
         ↓
    Verify
.com TLD Key
         ↓
    Verify
example.com Key
         ↓
    Verify
DNS Records

Key Types

KSK (Key Signing Key)

Purpose: Sign DNSKEY records
Characteristics: Long-term use, changes require updating parent domain's DS record
Key Length: Typically 2048-4096 bits

ZSK (Zone Signing Key)

Purpose: Sign all other records in the zone
Characteristics: Regular rotation, doesn't affect trust chain
Key Length: Typically 1024-2048 bits

Dual Key Strategy Benefits:

Regular ZSK rotation improves security
Long-term stable KSK reduces DS record updates

DNSSEC Deployment Steps

1. Generate Keys

bash
# Generate KSK
dnssec-keygen -f KSK -a RSASHA256 -b 2048 example.com

# Generate ZSK
dnssec-keygen -a RSASHA256 -b 1024 example.com

2. Sign Zone

bash
# Sign zone file
dnssec-signzone -K . -o example.com example.com.db

3. Upload DS Record to Parent Domain

bash
# View DS record
dnssec-dsfromkey Kexample.com.+008+12345

# Add DS record to parent domain (e.g., .com)

4. Configure DNS Server

bind
; named.conf
options {
    dnssec-validation auto;
    dnssec-lookaside auto;
};

DNSSEC Advantages

Security Improvement

Threat Type	DNSSEC Protection
DNS Cache Poisoning	✅ Complete protection
Man-in-the-Middle Attacks	✅ Complete protection
DNS Spoofing	✅ Complete protection
Data Tampering	✅ Complete protection

Trust Mechanism

Top-down trust chain: Verify from root key
Digital signatures: Ensure data hasn't been tampered with
Public key encryption: Prevent large-scale attacks from private key leaks

DNSSEC Challenges

1. High Deployment Complexity

Need to configure key management
Regular key rotation
Maintain trust chain

2. Performance Impact

Increased DNS response size (includes signatures)
Additional DNS queries needed for DNSKEY
Signature verification requires computing resources

3. Compatibility Issues

Some old DNS clients don't support it
Some network devices may drop large DNS responses

4. EDNS0 Dependency

DNSSEC requires EDNS0 support
Needs larger UDP packets (over 512 bytes)

DNSSEC Status

Global Deployment

Zone	DNSSEC Support
Root Domain	✅ Signed since 2010
.com	✅ Signed
.org	✅ Signed
.net	✅ Signed
.cn	✅ Signed
Some Second-Level Domains	⚠️ Partial support

Check DNSSEC Status

bash
# Check using dig
dig +dnssec www.example.com

# Visualize using dnsviz
dnsviz www.example.com

# Online tools
- https://dnssec-debugger.verisignlabs.com/
- https://dnsviz.net/

DNSSEC Best Practices

1. Key Management

bash
# Regularly rotate ZSK (e.g., every 90 days)
# KSK can be long-term (1-2 years)

# Securely store private keys
# Use HSM (Hardware Security Module)
# Limit private key access permissions

2. Signing Strategy

dns
; Set reasonable signature validity periods
RRSIG: 30 days validity
NSEC/NSEC3: Same as zone TTL

3. Monitoring and Alerts

Monitor signature expiration times
Set key rotation reminders
Monitor DNSSEC verification failure rates

4. Testing and Verification

bash
# Thorough testing before deployment
dnssec-verify example.com.db

# Test with multiple verification tools
dig +dnssec +adflag www.example.com

Common Interview Questions

Q: Can DNSSEC prevent DNS hijacking?

A: DNSSEC can prevent DNS hijacking and spoofing during transmission, but cannot prevent:

Client local DNS configuration tampering
Attackers controlling authoritative DNS servers
Local hosts file modification

Q: Why does DNSSEC need EDNS0?

A: DNSSEC signatures and key data increase DNS response size. Traditional DNS's 512-byte UDP packet limit is insufficient. EDNS0 extends DNS protocol to support larger packet sizes.

Q: What's the difference between KSK and ZSK?

KSK (Key Signing Key): Signs DNSKEY records, long-term use, changes require updating parent domain's DS record
ZSK (Zone Signing Key): Signs other records in the zone, regular rotation, doesn't affect trust chain

Q: Does DNSSEC affect DNS performance?

A: It has some impact:

Increased DNS response size (includes signatures)
Additional DNSKEY queries needed
Signature verification requires computing resources
But modern networks and hardware typically accept it

Summary

Aspect	Description
Core Function	Ensure integrity and authenticity of DNS data
Technical Foundation	Asymmetric encryption, digital signatures, trust chain
Key Records	DNSKEY, DS, RRSIG, NSEC/NSEC3
Key Types	KSK (long-term), ZSK (regular rotation)
Deployment Challenges	High complexity, performance impact, compatibility
Deployment Status	Root domain and major TLDs support it