Task Statement 2.3: Implement complex hybrid and multi-account DNS architectures.

📘AWS Certified Advanced Networking – Specialty

1. Why DNSSEC is Needed

Standard DNS has a major weakness:

It does not verify whether a DNS response is genuine.
Attackers can perform DNS spoofing/cache poisoning.
This can redirect users to malicious servers without detection.

Example in IT environment

An application queries DNS for an API endpoint.
Without DNSSEC → attacker could return a fake IP.
With DNSSEC → the response is verified before being trusted.

2. What DNSSEC Provides

DNSSEC adds two key security features:

1. Data Integrity

Ensures the DNS record has not been modified in transit.

2. Authentication of Origin

Confirms the response comes from the correct DNS zone owner.

❗ Important: DNSSEC does NOT encrypt data. It only verifies authenticity.

3. How DNSSEC Works (Simple Explanation)

DNSSEC works using cryptographic signatures.

Basic Flow:

DNS records are digitally signed.
Resolver receives:
- DNS answer
- Signature
Resolver verifies signature using a public key
If valid → trust the response
If invalid → reject it

4. Key Components of DNSSEC

Understanding these is critical for the exam.

4.1 DNSKEY Record

Stores the public key used to verify signatures.
Published in the DNS zone.

4.2 RRSIG Record

Contains the digital signature for DNS records.
Generated using the private key.

4.3 DS (Delegation Signer) Record

Connects parent zone → child zone.
Helps build the chain of trust.

4.4 NSEC / NSEC3 Records

Prove that a DNS record does NOT exist.
Prevent attackers from faking non-existent domains.

5. Chain of Trust (Very Important Concept)

DNSSEC works through a chain of trust starting from the root.

Structure:

Root zone → TLD → Domain → Subdomain

Each level:

Signs the next level
Verifies using DS records

Example flow:

Resolver trusts root key (pre-installed)
Root verifies TLD (.com, .org)
TLD verifies domain
Domain verifies its records

If any link fails → DNS response is rejected

6. Key Types in DNSSEC

There are two types of keys used:

6.1 Zone Signing Key (ZSK)

Used to sign DNS records
Rotated more frequently

6.2 Key Signing Key (KSK)

Used to sign the DNSKEY record
More secure and rotated less frequently

Key Relationship:

KSK signs ZSK
ZSK signs DNS data

7. DNSSEC Validation Process

Step-by-step:

Client sends DNS query
Resolver requests DNSSEC records
Resolver receives:
- DNS answer
- RRSIG
- DNSKEY
Resolver:
- Validates signature
- Verifies chain of trust
If everything is valid → response is accepted
Otherwise → SERVFAIL returned

8. DNSSEC in AWS (Very Important for Exam)

AWS primarily supports DNSSEC in Amazon Route 53.

8.1 DNSSEC Signing (Route 53)

Route 53 can sign your hosted zone
It generates:
- DNSKEY
- RRSIG records
Uses KMS (Key Management Service) for key storage

8.2 DNSSEC Validation

Route 53 Resolver does NOT perform DNSSEC validation
Validation is usually done by:
- Client resolver
- On-prem DNS servers

8.3 Enabling DNSSEC in Route 53

Steps:

Enable DNSSEC signing for hosted zone
Create KSK using AWS KMS
Add DS record to parent domain

8.4 Important AWS Limitations

Only supported for public hosted zones
Not supported for:
- Private hosted zones
- Internal-only DNS

9. DNSSEC in Hybrid Architectures

In hybrid setups (on-prem + AWS):

Common pattern:

On-prem resolver performs DNSSEC validation
AWS Route 53 performs DNSSEC signing

Key consideration:

Ensure forwarding rules preserve DNSSEC records
Avoid intermediate systems that strip signatures

10. Benefits of DNSSEC

Protects against DNS spoofing attacks
Ensures trustworthy DNS responses
Improves security posture for applications
Critical for:
- APIs
- Authentication systems
- Service discovery

11. Limitations of DNSSEC

Does NOT provide:
- Encryption
- Confidentiality
Adds:
- More DNS records (larger responses)
- Complexity in key management
Requires:
- Proper configuration of chain of trust

12. Exam Tips (Very Important)

Key points to remember:

DNSSEC = authentication + integrity, NOT encryption
Uses:
- DNSKEY, RRSIG, DS records
Chain of trust is core concept
KSK vs ZSK difference is frequently tested
Route 53:
- Supports DNSSEC signing
- Does NOT support validation
Works only for public hosted zones

13. Quick Summary

DNSSEC protects DNS from tampering
Uses digital signatures to verify data
Relies on a chain of trust from root to domain
Requires careful key management
In AWS:
- Route 53 signs DNS records
- Validation happens outside AWS (usually)