RFC 4033

Q: What does the Introduction section cover in RFC 4033 — DNSSEC?

The Introduction section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 4033 — DNSSEC. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the DNSSEC Resource Records section cover in RFC 4033 — DNSSEC?

The DNSSEC Resource Records section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 4033 — DNSSEC. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Chain of Trust section cover in RFC 4033 — DNSSEC?

The Chain of Trust section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 4033 — DNSSEC. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the DNSSEC Validation Process section cover in RFC 4033 — DNSSEC?

The DNSSEC Validation Process section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 4033 — DNSSEC. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Security Considerations section cover in RFC 4033 — DNSSEC?

The Security Considerations section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 4033 — DNSSEC. This content is part of the BLACKLABS RFC Reference Library.

BLACKLABS

DNS Security Introduction and Requirements

Standards Track Obsoletes: RFC 2535

March 2005

Abstract: DNSSEC provides origin authentication and data integrity for DNS responses using digital signatures. DNSSEC protects against DNS spoofing and cache poisoning attacks that could redirect 3GPP signaling to malicious endpoints.

Canonical source: https://www.rfc-editor.org/rfc/rfc4033 | IETF Datatracker

1. Introduction

▶

DNSSEC adds cryptographic signatures to DNS records, allowing resolvers to verify that DNS responses are authentic and unmodified. Without DNSSEC, DNS responses can be spoofed, redirecting traffic to attacker-controlled servers.

For 3GPP networks, DNS spoofing is a critical threat — compromised DNS could redirect Diameter signaling, IMS registration, or SBI discovery to malicious NFs. DNSSEC provides the foundation for trusted DNS resolution.

2. DNSSEC Resource Records

▶

Record Type	Description	Purpose
RRSIG	Resource Record Signature	Digital signature over an RRset
DNSKEY	DNS Public Key	Zone signing key and key signing key
DS	Delegation Signer	Hash of child zone's DNSKEY — chain of trust
NSEC/NSEC3	Next Secure	Authenticated denial of existence

3. Chain of Trust

▶

The chain of trust starts from a configured trust anchor (root zone DNSKEY) and follows DS records down through the DNS hierarchy to the target zone's signed records.

  Root (.)          → DNSKEY (root KSK/ZSK)
|                    ↓ signs
|               RRSIG for DS of .org
|
.org              → DNSKEY (org KSK/ZSK)
|                    ↓ signs
|               RRSIG for DS of 3gppnetwork.org
|
3gppnetwork.org   → DNSKEY (zone KSK/ZSK)
|                    ↓ signs
|               RRSIG for A/AAAA/SRV records
|
epc.mnc001.mcc208.3gppnetwork.org
→ SRV + RRSIG (verified!)

4. DNSSEC Validation Process

▶

Resolver requests DNS records with the DO (DNSSEC OK) bit set in EDNS0
Authoritative server returns records with RRSIG signatures
Resolver retrieves DNSKEY for the zone and verifies RRSIG
DS record in parent zone authenticates the DNSKEY
Chain continues up to the trust anchor (root)
If any signature is invalid → SERVFAIL (validation failure)

5. Security Considerations

▶

DNSSEC provides authentication and integrity but NOT confidentiality — queries/responses are still visible
DNSSEC amplification attacks can be used for DDoS — response sizes increase significantly
Key management (key rollover) must be handled carefully to avoid validation failures
NSEC can leak zone contents (zone enumeration) — NSEC3 provides hashed denial of existence