DNSSEC Done Right
Jan 29, 2015Ólafur Guðmundsson
Summary
This post details Cloudflare's approach to implementing and deploying DNSSEC, focusing on generating signatures at the edge on demand. It highlights the use of ECDSA P-256 for smaller signatures and faster generation, and NSEC with ECC keys for negative answers to minimize data volume and prevent zone walking. The goal is to keep most signed answers under 512 bytes.
More from the DNS Infrastructure & Naming Conventions trail
- The keys to the Internet change on October 11, 2026. Are you ready?
- 1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
- How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache
- BGP ORIGIN attribute manipulation and its impact on the Internet
- Cloudflare Internal DNS is now generally available