49 definitions associated with DNSSEC.
The Authenticated Data bit in a DNS response signals that the validating resolver considers the included answer and relevant proof data authentic according to DNSSEC. A stub should only trust the bit when it trusts the resolver and the transport path.
A resolver optimization that reuses validated NSEC or NSEC3 proofs to synthesize negative answers for other names covered by the proof. This can reduce authoritative queries and improve resilience during random-subdomain attacks.
A DNSSEC validation state indicating that the resolver expected a verifiable chain but validation failed. A validating resolver normally returns SERVFAIL rather than the unvalidated data unless policy says otherwise.
A deterministic ordering and representation of DNS names and record data used when creating or verifying DNSSEC signatures. It ensures different implementations calculate the same signed data.
The Checking Disabled bit in a DNS query asks a validating resolver to return data without enforcing DNSSEC validation failure for that transaction. It is typically used by a client that intends to validate independently.
A Child DNSKEY record published by a child to request that the parent create or update a corresponding DS record. It is an alternative signal to CDS for automated delegation maintenance.
A Child DS record published in a child zone to signal desired DS changes to the parent. It supports automated DNSSEC delegation maintenance when the parent follows a defined acceptance policy.
A TLSA record binds a TLS service endpoint to an expected certificate or public key. It is the core DNS record used by DANE and is meaningful when protected by DNSSEC.
The sequence of validated signatures and delegation records that links a configured trust anchor to signed data. At a secure delegation, the parent's DS authenticates the child's DNSKEY set.
A DNSSEC design that reduces or avoids the traditional zone-enumeration and response-size costs of NSEC or NSEC3 while still proving nonexistence. Specific mechanisms depend on the authoritative implementation and standards in use.
DNS-Based Authentication of Named Entities, a family of mechanisms that uses DNSSEC-protected records to associate services with certificates or public keys. TLSA is the best-known record used by DANE.
A record in a parent zone that authenticates a DNSKEY in the child zone. It forms the secure link between parent and child in the DNSSEC chain of trust.
Cryptographic proof that a queried name or record type does not exist in a signed zone. NSEC and NSEC3 are the classic mechanisms used to provide the proof.
A record containing a public key used to verify DNSSEC signatures made by the corresponding private key. DNSKEYs commonly serve as zone-signing or key-signing keys based on operational role.
DNS Security Extensions add origin authentication and integrity protection to DNS data through digital signatures and authenticated denial of existence. DNSSEC does not encrypt queries or responses.
The process of verifying DNSSEC signatures and chains of trust from a configured trust anchor. The result is commonly classified as secure, insecure, bogus, or indeterminate.
The DNSSEC OK bit in the EDNS OPT record indicates that a requester can receive DNSSEC-related records in the response. It does not by itself request or prove validation.
A Delegation Signer record in a parent zone contains a digest of a child DNSKEY and identifies the algorithm and digest type. It creates a signed delegation in the chain of trust.
The cryptographic digest function used in DNSSEC operations such as DS records or NSEC3 hashing. Algorithm agility allows older digest methods to be replaced as security expectations change.
A DNSSEC state in which a validator cannot determine whether data should be considered secure, insecure, or bogus, often because required information is unavailable or an unsupported algorithm is involved. Exact handling depends on the validating implementation and policy.
A model in which an authoritative system accepts or stores unsigned zone data and automatically generates and serves the signed version. It separates content management from cryptographic signing operations.
A delegation from a signed parent that intentionally has no DS record for the child, indicating that the child is not part of the DNSSEC chain of trust. Validators can accept the child's unsigned answers as insecure rather than bogus.
A controlled process for generating, activating, backing up, rolling, or retiring cryptographic keys, often with documented roles and evidence. It is especially important for high-trust trust anchors and KSKs.
The planned replacement of a DNSSEC key while maintaining a valid chain of trust and continuous validation. Rollovers require timing that accounts for TTLs, signature validity, parent DS updates, and publication overlap.
An operational role for a DNSKEY that primarily signs the DNSKEY RRset. A parent DS normally points to a KSK, though DNSSEC protocol flags do not fully enforce operational roles.
A 16-bit value calculated from a DNSKEY and included in RRSIG and DS records to help identify the relevant key. It is an index hint, not a globally unique identifier.
The common abbreviation for Key Signing Key. It is usually the key whose digest is represented by the parent DS record.
A DNSSEC record that links to the next existing name in canonical order and lists record types present at its owner. It proves name or type nonexistence but can permit zone walking.
A flag allowing NSEC3 chains in delegation-heavy zones to omit some unsigned delegations. It reduces signing cost but changes the security proof around insecure delegations.
A hashed denial-of-existence record designed to make straightforward zone enumeration more difficult than NSEC. It adds iterations, salt, and opt-out behavior, with operational and computational tradeoffs.
A zone-apex record publishing the NSEC3 parameters used to generate hashed owner names, such as algorithm, iterations, and salt. Validators primarily rely on parameters in NSEC3 records themselves.
A DNS record type assigned for compact denial of existence. It is intended to support efficient authenticated nonexistence mechanisms defined by its associated specification.
A model in which zone data is signed outside the serving authoritative server, then transferred or published as a signed zone. It can isolate private keys but adds publication and freshness complexity.
A feature, most notably NSEC3 opt-out, that lets a signed delegation-centric zone omit some insecure delegations from the authenticated chain. It improves scalability but weakens proof granularity around those delegations.
A generic informal reference to a protocol or algorithm code point. Documentation should use the exact registry field, such as DNSSEC algorithm number, digest type, or option code, to avoid ambiguity.
A DNSSEC signature record covering an RRset. It identifies the covered type, algorithm, signer, key tag, inception and expiration times, and cryptographic signature.
A validation state indicating that DNS data has a valid chain of trust to a configured trust anchor and its signatures verify successfully.
A delegation in which the parent publishes a valid DS record for the child, allowing validators to continue the chain of trust into the child zone.
A DNSKEY used directly as a configured trust anchor, normally validated through its self-signature and an out-of-band trust process rather than a parent DS record.
The time after which an RRSIG is no longer valid. Signing automation must refresh signatures early enough to survive outages, propagation, and clock differences.
The time before which an RRSIG is not yet valid. Signers often backdate inception slightly to tolerate clock skew.
The system or process that creates RRSIG records using DNSSEC private keys. It may run inline on an authoritative server, on a hidden primary, in an HSM-backed service, or offline.
A record that associates a TLS service with an expected certificate or public key using usage, selector, and matching fields. Secure use depends on DNSSEC validation.
A configured DNSKEY or DS record that a validator accepts as the starting point for a chain of trust. The root DNSKEY is the most common public-DNS trust anchor.
A compact bitmap listing the resource-record types present at an owner name, used in NSEC and NSEC3 records to prove the absence of a requested type.
A delegation to a child zone without a parent DS record. From a signed parent it creates an intentional insecure boundary rather than a secure chain.
A recursive resolver that performs DNSSEC validation and classifies responses as secure, insecure, bogus, or indeterminate. It may set AD for trusted clients when validation succeeds.
An operational DNSSEC key role primarily used to sign ordinary zone RRsets. ZSKs are often shorter-lived and rolled more frequently than KSKs.
Abbreviation for Zone Signing Key, the operational key commonly used to sign most zone RRsets.