🔏

DNSSEC — Signed DNS

Complex

Free preview · 2 of 6 steps

DNS cache poisoning: the problem DNSSEC solves

DNS responses are unauthenticated — a classic DNS reply has no signature. The Kaminsky attack (2008) showed an attacker could poison a resolver's cache by flooding it with fake responses before the real one arrived, redirecting all users of that resolver to a malicious IP.

DNSSEC adds cryptographic signatures to DNS records, forming a chain of trust from the root down to every hostname.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step