49 definitions associated with DNSSEC.
49 matching terms
Page 1 of 3The Authenticated Data bit in a DNS response signals that the validating resolver considers the included answer and relevant proof data authentic according to DNSSEC. A stub should only trust the bit when it trusts the resolver and the transport path.
Read definitionA resolver optimization that reuses validated NSEC or NSEC3 proofs to synthesize negative answers for other names covered by the proof. This can reduce authoritative queries and improve resilience during random-subdomain attacks.
Read definitionA DNSSEC validation state indicating that the resolver expected a verifiable chain but validation failed. A validating resolver normally returns SERVFAIL rather than the unvalidated data unless policy says otherwise.
Read definitionA deterministic ordering and representation of DNS names and record data used when creating or verifying DNSSEC signatures. It ensures different implementations calculate the same signed data.
Read definitionThe Checking Disabled bit in a DNS query asks a validating resolver to return data without enforcing DNSSEC validation failure for that transaction. It is typically used by a client that intends to validate independently.
Read definitionA Child DNSKEY record published by a child to request that the parent create or update a corresponding DS record. It is an alternative signal to CDS for automated delegation maintenance.
Read definitionA Child DS record published in a child zone to signal desired DS changes to the parent. It supports automated DNSSEC delegation maintenance when the parent follows a defined acceptance policy.
Read definitionA TLSA record binds a TLS service endpoint to an expected certificate or public key. It is the core DNS record used by DANE and is meaningful when protected by DNSSEC.
Read definitionThe sequence of validated signatures and delegation records that links a configured trust anchor to signed data. At a secure delegation, the parent's DS authenticates the child's DNSKEY set.
Read definitionA DNSSEC design that reduces or avoids the traditional zone-enumeration and response-size costs of NSEC or NSEC3 while still proving nonexistence. Specific mechanisms depend on the authoritative implementation and standards in use.
Read definitionDNS-Based Authentication of Named Entities, a family of mechanisms that uses DNSSEC-protected records to associate services with certificates or public keys. TLSA is the best-known record used by DANE.
Read definitionA record in a parent zone that authenticates a DNSKEY in the child zone. It forms the secure link between parent and child in the DNSSEC chain of trust.
Read definitionCryptographic proof that a queried name or record type does not exist in a signed zone. NSEC and NSEC3 are the classic mechanisms used to provide the proof.
Read definitionA record containing a public key used to verify DNSSEC signatures made by the corresponding private key. DNSKEYs commonly serve as zone-signing or key-signing keys based on operational role.
Read definitionDNS Security Extensions add origin authentication and integrity protection to DNS data through digital signatures and authenticated denial of existence. DNSSEC does not encrypt queries or responses.
Read definitionThe process of verifying DNSSEC signatures and chains of trust from a configured trust anchor. The result is commonly classified as secure, insecure, bogus, or indeterminate.
Read definitionThe DNSSEC OK bit in the EDNS OPT record indicates that a requester can receive DNSSEC-related records in the response. It does not by itself request or prove validation.
Read definitionA Delegation Signer record in a parent zone contains a digest of a child DNSKEY and identifies the algorithm and digest type. It creates a signed delegation in the chain of trust.
Read definitionThe cryptographic digest function used in DNSSEC operations such as DS records or NSEC3 hashing. Algorithm agility allows older digest methods to be replaced as security expectations change.
Read definitionA DNSSEC state in which a validator cannot determine whether data should be considered secure, insecure, or bogus, often because required information is unavailable or an unsupported algorithm is involved. Exact handling depends on the validating implementation and policy.
Read definitionA model in which an authoritative system accepts or stores unsigned zone data and automatically generates and serves the signed version. It separates content management from cryptographic signing operations.
Read definitionA delegation from a signed parent that intentionally has no DS record for the child, indicating that the child is not part of the DNSSEC chain of trust. Validators can accept the child's unsigned answers as insecure rather than bogus.
Read definitionA controlled process for generating, activating, backing up, rolling, or retiring cryptographic keys, often with documented roles and evidence. It is especially important for high-trust trust anchors and KSKs.
Read definitionThe planned replacement of a DNSSEC key while maintaining a valid chain of trust and continuous validation. Rollovers require timing that accounts for TTLs, signature validity, parent DS updates, and publication overlap.
Read definition