DNS 101 Miniseries - #7 - DNSSEC Chain of Trust

DNSSEC strengthens authentication in DNS using digital signatures based on public key cryptography. With DNSSEC, it's not DNS queries and responses themselves that are cryptographically signed, but rather DNS data itself is signed by the owner of the data.

This video shows how the chain of TRUST is created between PARENT and CHILD zones within DNS.

FOLLOW ME 😺

OTHER VIDEOS AND PLAYLISTS 🎞

All rights reserved © 2022 Adrian Cantrill

[jean-patricktemanin]

thank you Adrian . You are a blessing for the IT world . I follow you on linkedin, slack . I live in France .

[JoseGuzmanRomero]

great videos, the best found so far, excellent job. Great EVERYTHING!

[nijuyonkadesu]

Now I can't imagine explaining chain of trust to someone without referring notes 💀
It is complex, and flow goes here and there

[mohamednaitmoussa]

Great video, thank you for this high quality content

[LryuzakiLN]

I have question, so if i modify/change any DNS record or if i add any new entry, do i need to regenerate the DS?

[guysgofish]

Hi, great video lessons its easy to follow and understand. I have a question tho how is the ksk generated and if we want to change our zones ksk we need to involve the parent zone and update its ds records?

[real-tee]

thank you so much, and I have a little question, why should a zone have a its own public ksk in its dnskey rrset?

[vegario]

I just didnt get one thing, does the end user that originate the request has to verify the chain of trust as well?

[admondallo]

I'm very very new to IT and also new to blockchain tech, but just from my very very basic understanding of the two, it seems like blockchain would streamline this (to me) very complicated process.

As a side note... My personal key chain has my car key fob and my apartment key fob. I don't like carrying too many keys in my pocket and DNSSEC has wayyyy too many keys =P haha!

[T-Sav]

So thought id write this out
You get a RRSET, need to verify its real? how, check for the RRSIG for it- use the RRSIG to verify the RRSET is real, how? use the ZSK (DNSKEY 256) to check the RRSIG. Need to verify the ZSK is real, how? Check for the ZSK RRSIG, use the ZSK RRSIG to verify its real, how? use the KSK (DNS KEY 257), how to verify the KSK is real? Oh there's a DS record in parent that's a hash.. how to verify that is real - check the RRSIG (Start again) - let me know if it helps