Domain Name System Security Extensions (DNSSEC)

DNS infrastructure consists of two primary types of servers:

1. DNS Content Servers (Authoritative Servers): These manage the actual domain information.
2. DNS Cache Servers (Name Servers): These query content servers on behalf of clients and temporarily store the responses in cache for a specified period to serve similar future requests without repeated queries.

If malicious or incorrect data gets stored in the cache ('poisoned cache'), the DNS cache server could supply clients with an incorrect IP address, redirecting them to fraudulent sites. This deliberate exploitation is known as DNS cache poisoning. It occurs because DNS communication between servers uses the stateless UDP protocol, which lacks sender verification. By skillfully timing spoofed response packets to align with legitimate requests, attackers execute cache poisoning.

DNSSEC mitigates this by introducing cryptographic validation. Authoritative DNS content servers generate a pair of cryptographic keys—a private key and a publicly accessible key. When responding to a query, the server uses its private key to sign the DNS response. The DNS cache server, upon receiving the response, validates the digital signature using the public key. This process ensures the integrity and authenticity of the data, effectively preventing DNS cache poisoning attacks.