Security: DNSSEC and DNS over HTTPS

The problem: DNS was built without security

Standard DNS has a fundamental flaw: it was designed in the 1980s with no authentication. When your computer asks "What is the IP for bank.com?", the response is a plain UDP packet with no proof of origin. An attacker positioned between your computer and the DNS resolver — or one who has compromised a caching resolver — can intercept the query and reply with a forged answer pointing to a malicious server. Your computer has no way to detect the deception. This attack is called DNS Cache Poisoning (or DNS Spoofing).

DNSSEC (DNS Security Extensions)

DNSSEC adds cryptographic authentication to DNS. It does not encrypt DNS traffic (queries and responses are still visible to observers). Instead, it digitally signs DNS records so that resolvers can verify the data has not been tampered with.

The chain of trust works like this:

1. The root zone is signed with a well-known public key (the Root KSK, or Key Signing Key). This key is distributed with operating systems and resolvers.
2. Each TLD (.com, .org) has its own signing keys, and the root zone signs a hash of those keys — creating a delegation of trust.
3. Each domain's authoritative server signs its own records. The TLD zone signs a hash of the domain's keys.
4. A DNSSEC-validating resolver follows this chain from the root down to the record, verifying each signature. If any signature is invalid or missing where one is expected, the resolver returns SERVFAIL rather than a potentially poisoned answer.

Root KSK → signs → .com KSK → signs → example.com KSK → signs → A record

DNSSEC does NOT protect against:
- Surveillance (your queries are still visible — use DNS over HTTPS/TLS for that)
- Attacks on the authoritative server itself
- Misconfiguration (a broken DNSSEC setup causes legitimate queries to fail)

DNS over HTTPS (DoH) and DNS over TLS (DoT)

Traditional DNS queries are sent in plaintext over UDP port 53. Anyone on your network path — your ISP, a coffee shop router, a government-level observer — can see every domain you look up. DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt DNS queries so they are indistinguishable from normal HTTPS traffic (DoH) or sent over an encrypted TLS tunnel (DoT).

• DoH sends DNS queries as HTTPS requests to a resolver endpoint (e.g., https://cloudflare-dns.com/dns-query). It uses port 443 and blends in with regular web traffic.
• DoT uses a dedicated TLS connection on port 853.

Both protect the privacy of your queries. Neither replaces DNSSEC — they solve different problems. DNSSEC ensures the answer is authentic; DoH/DoT ensures the query and answer are private in transit.