DNSSEC: Complexities and Considerations
Nov 5, 2014Nick Sullivan
Summary
This post details the complexities of DNSSEC, specifically focusing on zone content exposure through NSEC and NSEC3 records, and the challenges of key management. It explains how NSEC records can reveal all subdomains in a zone and how NSEC3, while intended to mitigate this, can still be vulnerable to dictionary attacks. The post also discusses 'DNSSEC white lies' as a mitigation technique requiring real-time signing, and contrasts different key management modes (offline, centralized online, live signing).
More from the DNS Infrastructure & Naming Conventions trail
- The keys to the Internet change on October 11, 2026. Are you ready?
- 1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
- How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache
- BGP ORIGIN attribute manipulation and its impact on the Internet
- Cloudflare Internal DNS is now generally available