DNSSEC Record Types
DNSSEC (DNS Security Extensions, RFC 4033/4034/4035) adds cryptographic authentication to DNS. It uses four new record types to establish a chain of trust from the root zone to individual RRsets, preventing cache poisoning and spoofing attacks.
Chain of trust
Root (.) DNSKEY → DS in root validates .com DNSKEY → DS in .com validates example.com DNSKEY → RRSIG signs A/MX records
DNSKEY (type 48, RFC 4034) holds the public key used to sign a DNS zone. Each zone has at least two keys: the Zone Signing Key (ZSK, flags=256) used to sign individual RRsets, and the Key Signing Key (KSK, flags=257) used to sign the DNSKEY RRset itself. The KSK's hash is published as a DS record in the parent zone, forming the chain of trust from the root zone down.
DS (Delegation Signer, type 43, RFC 4034) establishes the chain of trust between a parent zone and a child zone. The DS record in the parent zone (e.g., .com) contains the cryptographic hash of the child zone's KSK DNSKEY record. When a resolver validates example.com, it verifies that the DS record in .com matches the KSK in example.com's DNSKEY RRset, then uses that KSK to verify the child zone's signatures.
RRSIG (Resource Record Signature, type 46, RFC 4034) is the cryptographic signature over a DNS RRset. Every RRset in a DNSSEC-signed zone has a corresponding RRSIG record signed by the zone's ZSK (or KSK for the DNSKEY RRset). Validating resolvers verify the RRSIG against the appropriate DNSKEY to confirm the RRset has not been tampered with. RRSIG records have a validity window (Signature Inception and Signature Expiration timestamps).
NSEC (Next Secure, type 47, RFC 4034) proves authenticated denial of existence. When a DNSSEC-signed zone is queried for a name or type that does not exist, the authoritative server returns the NSEC record that spans the gap in the zone's sorted namespace. NSEC records form a linked list of all names in the zone. The vulnerability: NSEC allows zone enumeration (walking the entire zone by following the chain), which led to the development of NSEC3.
NSEC3 (type 50, RFC 5155) is the zone-enumeration-resistant successor to NSEC. Instead of linking actual domain names, NSEC3 links SHA-1 hashes of domain names in sorted order. An attacker querying for non-existent names receives hashed NSEC3 records that prove non-existence but cannot be trivially reversed to discover zone contents. NSEC3PARAM records specify the hashing parameters (algorithm, iterations, salt). Offline dictionary attacks against NSEC3 hashes remain possible, which led to the development of NSEC3 opt-out and later NSEC5 (in development).