03
What does DNSSEC protect against?
Attacks and sabotage attempts on the DNS pose an enormous threat. A global DNS hijacking campaign last made headlines in 2019. At that time, the Internet Corporation for Assigned Names and Numbers (ICANN) issued an urgent warning about the attacks, which targeted dozens of domains belonging to government, telecommunications, and internet infrastructure organizations in Europe, North America, North Africa, and the Middle East. Political actors are believed to have been behind the attacks, pursuing primarily political goals with the global campaign.
By means of DNS hijacking, attackers are able to redirect regular requests for web pages without detection, e.g., to obtain user credentials on fake web pages, to spread malware, or to dox political/ideological opponents. DNS hijacking can also be used to censor access to specific websites.
04
How widespread is DNSSEC?
The go-ahead for DNSSEC was given in 1999, but the DNS security extension has not yet gained global acceptance. This was in no small part due to teething troubles that required extensive improvements. The original version of DNSSEC (RFC 2535) had to be revised to simplify key management and to eliminate compatibility problems with existing software. It was not until 2005 that the new version of the DNSSEC protocol was finally launched with the publication of RFC 4033, RFC 4034, and RFC 4035. In 2008, this was eventually followed by NSEC3 resource records (RFC 5155), an option to reduce the risk of zone-walking attacks that had existed until then. Since 2010, DNSSEC has been deployed on all 13 root servers, and virtually all top-level domains now support the DNS security extension. Nevertheless, the global validation rate of DNSSEC is still below the 30 percent mark.
Complexity as a stumbling block for DNSSEC
One of the reasons for the slow adoption of DNSSEC is the high level of complexity associated with the use of the extension. It is not enough, for example, for root servers and the administrators of top-level domains to support the standard. For a successful integrity check, the domain name registrar, DNS server operator, and the internet access provider (resolver) must also support the standard and configure it in a coordinated manner.
DNSSEC in Germany
In Germany, or rather the .de zone, DNSSEC was introduced in 2011. The German Federal Office for Information Security (BSI) held a DNSSEC Day in 2015 to provide information and encourage adoption of the technology. The BSI also recommends the use of DNSSEC to secure digital communication in the technical guideline “Secure E-Mail Transport” (BSI TR-03108). According to the authority, business-critical domains in particular benefit from the additional layer of protection provided by DNSSEC. In Germany, it is primarily government agencies and organizations from highly regulated sectors (finance, insurance, healthcare, etc.) that rely on DNSSEC. According to APNIC Labs, the overall validation rate in Germany is above 50 percent, slightly higher than the Western European average.
06
What you need to know about DNSSEC
DNSSEC is a suite of security extensions that performs authentication of the source during name resolution. The technology can be used to validate the integrity of web servers and the connections established with them. This ensures that a specific domain is in fact assigned to the correct web server. Sabotage attempts can thus be detected and thwarted. DNSSEC can also be used to safeguard the integrity of digital communication via e-mail or VoIP.
However, due to its considerable complexity and a number of teething problems, the standard has not yet gained global acceptance. Nevertheless, a general trend towards its adoption can be observed. Organizations from sensitive sectors in particular are increasingly turning to DNSSEC, especially when it comes to securing business-critical domains.
The lack of encryption is often seen as one of the shortcomings of DNSSEC. In addition, DDoS attacks, both from and to DNSSEC-validating web servers, pose a significant potential threat. Cybercriminals are able to abuse the technological features of the standard to amplify and conceal their attacks. At the same time, DNSSEC-validating web servers are more vulnerable to DDoS attacks because they must cope with a higher computational load during name resolution.