Could DNSSEC have protected the DNS against recent attacks?

ICANN called for the adoption of DNSSEC

It was recently revealed that cybercriminals had attacked the Domain Name System (DNS) with the aim of intercepting commercial and governmental internet traffic. Following the attacks, ICANN called for the adoption of DNSSEC, saying it would effectively frustrate any similar assaults in the future. The call received a mixed response, with some people questioning DNSSEC's ability to provide protection when – as in the reported cases – the attacker has the DNS provider's log-in details.

DNSSEC validates a responding name server

DNSSEC is a protocol that uses asymmetric cryptography to validate the data provided by a DNS server. Ordinarily, a computer will accept the first reply it receives, without checking that the sender is trustworthy. That's obviously a security issue, which is why DNSSEC was developed.

DNSSEC doesn't identify the server

DNSSEC doesn't confirm a server's identity, as an EV TLS certificate does. If a DNS server is hacked, the hacker can ultimately negate the benefit of DNSSEC by replacing the 'real' DNSSEC data with data that appears to be valid, but doesn't really belong to the DNS record in question. Under such circumstances, DNSSEC is merely a fire retardant: the hacker has to change a lot more data in order to redirect the traffic. What's more, the hacker's changes will soon be picked up, because the falsified data won't match the data in the zone file (e.g. the .nl zone file managed by SIDN).

Validation necessary

DNSSEC is effective only if internet users whose machines send DNS queries do actually validate the DNSSEC data that they get in response. That can be done using a service such as Google Public DNS, CloudFlare DNS or Quad9. However, many internet service providers don't yet support validation. That's down to them being unfamiliar with the standard and/or seeing validation as a low priority.

DNSSEC isn't a panacea

Conclusion: DNSSEC can certainly help to frustrate attacks on the DNS when it's used as part of a raft of measures including TLS. ICANN recognises that DNSSEC isn't an answer on its own, and describes it as part of a package of protection measures.



  • Thursday 14 June 2018


    Green padlock symbol doesn't guarantee security. So what does?


    How can you show that your website is trustworthy?

    Read more
  • Friday 22 March 2019


    Brands and regions: the dotamazon case


    Retailer versus region

    Read more
  • Monday 3 December 2018


    Average Dutch person on line with a smartphone for 60+ hours a month


    SIDN presents research results: Trends in Internet Use 2018

    Read more


Your browser is too old to optimally experience this website. Upgrade your browser to improve your experience.