Task Statement 4.3: Implement and maintain confidentiality of data andcommunications of the network.

📘AWS Certified Advanced Networking – Specialty

1. Why DNS Security is Needed

The DNS system converts domain names (like example.com) into IP addresses.

However, normal DNS has a major problem:

DNS responses are not authenticated
Attackers can perform:
- DNS spoofing
- DNS cache poisoning
- Man-in-the-middle attacks

This means a user can be redirected to a fake AWS application endpoint or malicious server, even if they typed the correct domain.

👉 So, DNS security methods are used to ensure:

The DNS response is authentic
The data is not modified
The response comes from the real DNS authority

2. What is DNSSEC?

DNSSEC (Domain Name System Security Extensions) is a set of security extensions for DNS that adds cryptographic validation to DNS responses.

It does NOT encrypt DNS traffic. Instead, it ensures:

✔ Integrity (data is not changed)
✔ Authenticity (data comes from a trusted source)
✔ Trust chain validation

3. How DNSSEC Works (Simple Technical Flow)

DNSSEC uses digital signatures and public key cryptography.

Step-by-step process:

Step 1: DNS Zone Signing

The DNS zone owner (for example, a domain hosted in Route 53) generates:
- A private key
- A public key
DNS records are signed using the private key

Step 2: Signature is Attached

Each DNS record gets a:

RRSIG record (digital signature)

This signature proves that the record is valid and unchanged.

Step 3: Public Key is Published

The public key is published in DNS using:

DNSKEY record

Step 4: Validation by Resolver

When a DNS resolver (like AWS Route 53 Resolver or ISP resolver) queries a domain:

It checks:

DNS record signature (RRSIG)
Public key (DNSKEY)
Chain of trust

Step 5: Chain of Trust Verification

DNSSEC uses a hierarchy:

Root DNS zone
Top-level domain (TLD) like .com
Authoritative domain (example.com)

Each level signs the next level using DS (Delegation Signer) records.

If all signatures match:
✔ DNS response is trusted
If not:
❌ Response is rejected

4. Key DNSSEC Components (Important for Exam)

You must know these terms:

1. DNSKEY Record

Stores the public key
Used for verifying signatures

2. RRSIG Record

Digital signature of DNS data
Ensures integrity

3. DS Record (Delegation Signer)

Connects parent zone to child zone
Helps build chain of trust

4. NSEC / NSEC3 Records

Used to prove non-existence of a domain
Prevents attackers from forging “no record exists” responses

5. DNSSEC in AWS (Route 53)

AWS supports DNSSEC in Amazon Route 53 Hosted Zones.

Key AWS DNSSEC features:

✔ Domain signing in Route 53

You can enable DNSSEC for hosted zones

✔ Key Management

AWS uses AWS KMS (Key Management Service) to manage keys securely

✔ Key Types

Key Signing Key (KSK)
Zone Signing Key (ZSK)

KSK vs ZSK (Very Important for Exam)

Key Type	Purpose
KSK	Signs DNSKEY records (higher trust level)
ZSK	Signs all other DNS records

6. DNSSEC Validation Modes

DNS resolvers can behave in two ways:

1. Validating Resolver

Checks DNSSEC signatures
Rejects invalid responses

Example:

AWS Route 53 Resolver with DNSSEC validation enabled

2. Non-validating Resolver

Ignores DNSSEC
Does not verify authenticity

7. Benefits of DNSSEC

DNSSEC helps in:

✔ Preventing DNS spoofing
✔ Protecting API endpoints (e.g., AWS ALB DNS names)
✔ Ensuring correct routing to AWS resources
✔ Securing hybrid DNS environments (on-prem + AWS)

8. Limitations of DNSSEC (Exam Traps)

You should remember:

❌ DNSSEC does NOT encrypt DNS traffic
❌ It does NOT hide DNS queries
❌ It increases DNS response size (more overhead)
❌ Requires correct key management (complex setup)

9. DNSSEC in AWS Architecture (Real AWS Usage)

In AWS environments, DNSSEC is commonly used in:

✔ Secure hybrid networking

On-prem DNS ↔ Route 53 Resolver

✔ Multi-account AWS environments

Centralized DNS validation

✔ Public-facing applications

Protecting Route 53 public hosted zones

✔ Compliance requirements

Financial, government, enterprise security standards

10. Exam Key Points Summary

For AWS Advanced Networking exam, remember:

Must know:

DNSSEC provides authentication + integrity, not encryption
Uses public/private key cryptography
Uses RRSIG, DNSKEY, DS records
AWS Route 53 supports DNSSEC with KMS-based key management
Resolver must be DNSSEC-validating to enforce security

Final Simple Concept

👉 DNSSEC is like a verification system for DNS responses in AWS networking, ensuring that when a system resolves a domain name, the result is:

Authentic
Untampered
Verified through cryptographic trust chain