Gulf CybersecurityBaseline
العربيةCheck your domain
Kuwait City at night from space, its streets in amber light along the dark water of the bayRiyadh at night from space, a wide grid of white and amber light in the desertDubai at night from space, with Palm Jumeirah lit in the sea below the coast roadDoha at night from space, the city's lights spreading from the bay along its roadsBahrain at night from space, the island's towns joined by lit roads in a dark seaMuscat and Al Seeb at night from space, the coast road and the airport in amber light beside a dark sea

DNSSEC validates

Signed DNS (DNSSEC)

Can a resolver prove that the domain's DNS answers are genuine?

Why it matters

Without DNSSEC, a forged DNS answer can send visitors and mail to an attacker's servers. With it, validating resolvers reject any answer that lacks a valid signature chain back to the root. A domain can only be signed end to end if the suffix above it is signed too.

When a domain passes

Passes when validating resolvers mark the domain's answers as authenticated.

How to fix it

  1. Turn on DNSSEC signing at your DNS host.
  2. Give the DS record to the body that runs the suffix above the domain, then confirm that validation succeeds.
  3. Where the suffix itself is not signed, ask the body that runs it to sign it, since no domain under it can validate until then.

An example record

example.com  DS  370 13 2 BE74359954660069D5C63D200C39F5603827D7DD02B56F120EE9F3A86764247C

Reference specifications

All thirteen standards