DNSSEC: Security for Essential Network Services - Page 3 How
DNSSEC Works From our discussion so far, it is clear that DNS
has some major security issues that urgently need to be
addressed. The Internet and security engineering communities
have responded to the threats by developing DNSSEC, a new secure
DNS protocol, which addresses the data integrity and source-
spoofing issues by means of a public key distribution.
Interestingly, the extensions do not protect against buffer
overruns or DDoS types of attack, nor do they provide
confidentiality -- another major issue. To maintain as much
backwards compatibility as possible, the DNSSEC protocol
requires only minor changes to the DNS protocol. DNSSEC has
added four additional record types (SIG, KEY, DS, and NXT) and
two new message header bits (CD and AD). Because the UDP
protocol has a packet size limit of 512 bits, DNSSEC requires
the use of EDNS0 extensions that override the limitation so that
larger key sizes can be accommodated. The DNSSEC implementation
us