Уроки модуля (1/4)
Obiettivi e limiti di DNSSEC
DNSSEC goals and limits
DNSSEC lets a validating resolver check the origin and integrity of DNS data through cryptographic signatures and a chain of trust. It can make forged or altered answers detectable. It does not encrypt queries, hide the names being looked up, decide whether a website is trustworthy, or prevent changes made by an authorized but compromised account.
Think of DNSSEC as a tamper-evident seal whose trust starts from a known key. It helps answer “Did this data come through the expected chain and remain intact?” It does not answer “Is this service safe?” Transport privacy needs separate measures such as DoT or DoH.
Laboratorio guidato: Controllo della catena DNSSEC
Il caso mostra come una discrepanza DS/DNSKEY impedisca la validazione.
Simulazione didattica locale: nessuna query DNS viene inviata.
Follow the validation path: trust anchor → DS in the parent → DNSKEY in the child → RRSIG for the RRset. If a link does not match, do not call the data secure.
Check your understanding
Choose the best answer. This quiz runs locally and sends no DNS queries to real domains.
Which property does DNSSEC provide?