{"id":2499,"date":"2018-11-15T05:02:29","date_gmt":"2018-11-15T05:02:29","guid":{"rendered":"https:\/\/www.canspace.ca\/blog\/?p=2499"},"modified":"2020-01-15T23:37:57","modified_gmt":"2020-01-16T04:37:57","slug":"what-is-dnssec-and-why-does-my-website-need-it","status":"publish","type":"post","link":"https:\/\/www.canspace.ca\/blog\/security\/what-is-dnssec-and-why-does-my-website-need-it\/","title":{"rendered":"What is DNSSEC, and Why Does My Website Need It?"},"content":{"rendered":"

Over the past few years, online security has understandably risen in prominence. One thing that every website can do to promote better security is the adoption of Domain Name System Security Extensions (DNSSEC).<\/p>\n

DNSSECs add a special digital signature to a domain\u2019s DNS to affirm the authenticity of that source domain name. Why is this valuable? DNSSEC addresses a certain category of security risks and helps prevent malicious activities like cache poisoning, pharming, and man-in-the-middle attacks.<\/p>\n

Let\u2019s go over how this actually works in practice.<\/h4>\n

Say you open up your browser and type in a domain name like CanSpace.ca in the address bar. To be able to open that website, a resolver first needs to take the domain name and translate it to a numerical address (IP address) that identifies your site. The DNS is like the Internet\u2019s phone book.<\/p>\n

Unfortunately, the DNS protocol is not always a secure as it could be. It\u2019s actually possible for a hijacker to interrupt the process above, identify their own IP address with the domain the user has typed into their address bar, and ultimately send the user to a different web site (that may be styled deceptively to mimic the original) where valuable account and password information can be stolen.<\/p>\n

It\u2019s these kinds of activities that have made it necessary to increase security with the use of DNSSEC. DNSSEC makes this resolver first verify the domain\u2019s digital signature and compares it to one that\u2019s on file at the registry. If the signature doesn\u2019t match, it could mean that someone is pretending to be your website, and the process is interrupted to protect the visitor.<\/p>\n

\"\"Think of DNSSEC as the key that needs to go in the lock before the door between a domain name and the IP address of that same site can be opened.<\/p>\n

By securing the directory lookup, DNSSEC takes care of one crucial part of Internet security. Once you\u2019ve actually connected to the website in question, HTTPS can then protect the visitor from there on. These two systems are complementary.<\/p>\n

The DNSSEC verification process provides users with three significant benefits<\/a>:<\/p>\n