What is DNSSEC?

Short answer

DNSSEC (DNS Security Extensions) is the set of security extensions that enables DNS responses to be validated with digital signatures (RFC 4033). The records of the zone are signed with a private key; the validating resolver checks the signature with the public key and builds the chain of trust from the DS record in the parent zone down to the child zone. In this way, responses that were altered on the way or forged are rejected. DNSSEC does not provide privacy; the responses are not encrypted, they are only validated. In TR7 GTM, DNSSEC is turned on per domain with the DNSSEC switch (default Disabled); after it is turned on, the DNSSEC lock in the Domains list is clicked, and the DNSSEC Info for window that opens shows the DS records table to be submitted to the parent zone and the DNS KEY line.

Where It Is Used in TR7

Where	Field / label	What for
GTM → GTM Services → service name → Domains → Add / Edit	DNSSEC (Enabled / Disabled, default Disabled)	Turning signing on or off per domain
GTM → GTM Services → service name → Domains (list)	DNSSEC column: a green lock if DNSSEC is on, a gray open lock if it is off	Seeing which domains are signed
Same list → green lock	DNSSEC Info for window: DS Records (Key tag, Algorithm, Digest type, Digest) and DNS KEY (DNSSEC)	The DS values to be submitted to the registrar and the public key of the zone

Enabling DNSSEC in TR7

1. In the form of the domain, DNSSEC is set to Enabled and the form is saved; the keys of the zone are generated and the records are signed.
2. The green lock in the Domains list is clicked; the DS records values in the DNSSEC info window are entered at the registrar.
3. In a cluster, each device signs the zone with its own key and the window shows a separate DS table for each device; so that the response can be validated whichever device gives it, the DS records in both tables are submitted to the parent zone.

• On a service to which a DNS Forwarder Profiles profile is assigned, the DNSSEC records in the responses to the queries forwarded to upstream servers are passed to the client but are not validated.

Common Misconceptions

• "DNSSEC encrypts DNS traffic." DNSSEC only validates; the responses remain readable.
• "Turning DNSSEC on in TR7 is enough." Without the DS record being submitted to the parent zone, that is, to the registrar, the chain of trust is not established (What is a DS record; why is it submitted to the registrar in DNSSEC?).
• "A single DS record is enough in a cluster." Since the two devices sign with different keys, the DS records of both devices are published.

How it is done in the documentation

• Domains · DNSSEC
• Domains · Domains Listing Screen

Related questions

• What is a DS record; why is it submitted to the registrar in DNSSEC?
• What are DNSKEY, RRSIG and NSEC records?
• What is the difference between an authoritative DNS server and a recursive resolver?