| "DNS, is a scalable, distributed system, is highly vulnerable to exposure and the threats to the infrastructure are numerous. In order to thwart the threat of bogus and forged data in particular, the system must employ integrity validation of the responses received by the clients. If integrity of the DNS data is not maintained, a client may receive an invalid or forged response or may be misdirected to unauthorized locations without their knowledge.
The use of a Transaction Signature (TSIG) which provides a signature and hash of a message in conjunction to DNSSEC which verifies the source of a message can provide assurance of the integrity of the message.
Implementation of DNSSEC requires multiple parts to assure integrity.
Authoritative servers can provide DNSSEC information to clients including recursive servers.
Recursive servers can pass DNSSEC information from authoritative servers to clients.
Ultimately the DNS client must perform its own validation to ensure integrity."
|
