DNS Fundamentals
More to discover ↗A DNSSEC rollover replaces signing keys while keeping a valid chain of trust in place. Learn what to check before changing keys, how to stage a zone-signing key or key-signing key rollover, and when it is safe to remove old material.
Read article · 4 min↗A DNSSEC-signed zone can prove more than the contents of its records. NSEC and NSEC3 let a resolver verify that a requested name or record type is absent, while also accounting for wildcard names. Here is how the two methods work and where their protection ends.
Read article · 4 min↗DNSSEC helps a resolver check whether DNS answers are authentic and unchanged. Learn how DNSKEY records provide public keys, how RRSIG records cover sets of DNS records, and why a chain of trust is needed before either can be trusted.
Read article · 4 min↗A DS record is the link between a signed domain and its parent zone in DNSSEC. Learn where it lives, how a validating resolver uses it, and why keeping it aligned with the domain’s DNSKEY matters.
Read article · 4 min↗DNSSEC helps a validating resolver detect forged DNS answers, but it does not encrypt queries, secure a website or make every DNS record trustworthy. Learn how its chain of trust works, where its limits are, and what to check when a signed domain stops resolving.
Read article · 4 min↗
