Skip to content

DNS Security (DNSSEC)

This overview explains the basics of DNSSEC and defines which information must be provided to us as your hosting provider for delegation (chain of trust) if you operate your own name servers.

1. What is DNSSEC?

The classic DNS protocol is inherently unsecured. Attackers can manipulate responses and redirect users to the wrong servers (DNS spoofing / cache poisoning).

DNSSEC (Domain Name System Security Extensions) adds this missing layer of security. It does not encrypt DNS data, but it signs it with digital signatures. This allows the client (resolver) to verify beyond doubt whether the DNS response actually comes from the original name server and has not been altered in transit.

How does it work in principle?

  1. The zone gets an asymmetric key pair (private key & public key).
  2. All DNS records are signed with the private key (this creates RRSIG records).
  3. The public key is published in the zone as a DNSKEY record so clients can verify the signatures.

2. The Chain of Trust

For DNSSEC to work, the client must be able to trust the zone’s DNSKEY. To achieve this, a cryptographic fingerprint (hash) of this key is stored in the parent zone (for example at the .de registry) as a DS record (Delegation Signer). This creates a complete chain of trust from the root zone to your server.

3. Enabling DNSSEC

If you sign your zones on your own name servers, we as your hosting provider must establish the chain of trust to the parent registry for you.

For this, we absolutely require your public Key Signing Key (KSK).

Please send us the key exactly in the following format (consisting of four components): [Flags] [Protocol] [Algorithm] [Public Key]

Example:

257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KJCX/VWZI8Uq7NjQ...

To ensure that we can correctly create the DS record at the registry, it is important that you provide the correct key type:

  1. Flags (257): 257 defines that this is your Key Signing Key (KSK). (A value of 256 would only be your local Zone Signing Key, which cannot be used to build the chain of trust.)
  2. Protocol (3): This value is fixed and historically represents the DNSSEC protocol.

  3. Algorithm: The ID of the cryptographic algorithm you use. Common values are 8 or 13.

    • Possible values: 8, 10, 13, 14, 15, 16

  4. Public Key: The actual public key as a long Base64 string.

With this information, you can create the DNSSEC entry in the CCP under the domain management section Registry.