DNSSEC

on YouTube ↗46m

" summary

DNSSEC coverage includes exactly which DNS records are signed and how DS, DNSKEY and RRSIG form the chain of trust up to the root. It explains negative responses using NSEC3 hashed-iterator proofs (with configurable rounds and salt) and compares practical signing workflows (BIND live signing vs PowerDNS presign). It also covers TLSA/DANE deployment (mail servers such as Postfix can verify TLSA while browsers largely ignore it) and operational challenges like registrar DS updates requiring support tickets, higher CPU and cache-rollover complexity for large zones and secondaries.

AI-written summary · about

" chapters (7)

1. 0:00DNSSEC introduction
2. 3:40Signature chain basics
3. 8:39NSEC/NSEC3 negative responses
4. 18:34TLSA applications
5. 26:03Implementation challenges
6. 33:49Summary
7. 34:09Q&A

" related talks

• 27mA Longitudinal, End-to-End View of the DNSSEC EcosystemBalakrishnan Chandrasekaran, Bruce M. Maggs, Dave Levin, Taejoong Chung, Roland van Rijswijk-Deij, David R. Choffnes, Alan Mislove, Christo Wilson · 26th USENIX Security Symposium (USENIX Security '17)
• 01h 27mDNS at 30Jim Hague · ACCU 2017
• 18mThe parts of DNS nobody explained to youNico Kempe · DevWorld 2026
• 25mProtective DNS, DNS Encryption, & Zero-Trust: Tackling NSA GuidanceSteve Staden · RSAC 2022
• 12mYour Shield is My Sword: A Persistent Denial-of-Service Attack via the...Li Chen, Shuai Wang, Dan Li, Baojun Liu, Shuhan Zhang · USENIX Security '25
• 15mYou Depend on DNS, This Is How It Works and You Won't...Philip Rowlands · SREcon23 Europe/Middle East/Africa
• 16mAttacking with Something That Does Not Exist: 'Proof of Non-Existence' Can Exhaust DNS...Elias Heftrig, Haya Schulmann, Michael Waidner, Olivia Gruza, Oliver Jacobsen, Niklas Vogel · WOOT '24
• 20mEverything about DNS you never dared to ask!Ole Michaelis · ElixirConf EU 2022