Question 1

What is DNSSEC and how does it protect domains?

Accepted Answer

DNS Security Extensions (DNSSEC) adds cryptographic digital signatures to DNS records. When a resolver looks up your domain, it verifies signatures through a chain of trust from the ICANN root zone down to your apex domain, preventing DNS cache poisoning and man-in-the-middle spoofing.

Question 2

What causes a 'Bogus' DNSSEC error?

Accepted Answer

A Bogus error occurs when the parent registry DS record digest does not match the active Key Signing Key (KSK) in the child zone, or when an RRSIG signature is invalid or expired. Resolvers that enforce DNSSEC (such as Google 8.8.8.8 and Cloudflare 1.1.1.1) will return SERVFAIL and refuse to resolve the domain for any users.

Question 3

Why is RRSIG signature expiration monitoring critical?

Accepted Answer

Unlike TLS certificates which last for months or years, DNSSEC RRSIG signatures are typically valid for only 7 to 30 days. If an authoritative nameserver re-signing cron job fails, the signatures expire and cause an immediate global DNS outage.

Question 4

What is the difference between NSEC and NSEC3?

Accepted Answer

Both NSEC and NSEC3 provide authenticated denial of existence (proving that a non-existent subdomain does not exist). However, standard NSEC links records in alphabetical order, allowing attackers to 'walk' the zone and discover all subdomains. NSEC3 hashes hostnames to prevent zone walking.

Cryptographic Chain of Trust & Delegation Integrity

How DNSSEC Delegation Verification Works

Preventing Outages from Stalled Re-Signing