Manage DNS Security (DNSSEC)

For domains that are pointed to custom (third-party) nameservers in Zoho Domains, you can configure and manage DNSSEC (Domain Name System Security Extensions) by adding DS (Delegation Signer) records in Zoho Domains. This ensures that DNSSEC validation is completed at the registrar level and that your domain’s DNS responses can be securely validated across the internet.

What is DNSSEC

Domain Name System Security Extensions (DNSSEC) is a suite of extensions to the Domain Name System (DNS) that adds a layer of security to prevent certain types of attacks, such as cache poisoning and man-in-the-middle attacks. It does this by enabling DNS responses to be verified for authenticity and integrity.

How DNSSEC Works

• Digital Signatures: DNSSEC uses public key cryptography to sign DNS data. Each zone (a portion of the DNS namespace) has a pair of cryptographic keys: a private key used to sign the data and a public key used to verify the signatures.
• Resource Records: When a DNS record is created, it is signed with the zone's private key, creating a digital signature. This signature is stored in a new type of DNS record called a Resource Record Signature (RRSIG).
• Chain of Trust: DNSSEC establishes a chain of trust from the root DNS servers down to the individual domain names. Each zone's public key is stored in the parent zone, allowing for verification of the child zone's signatures.
• Validation Process: When a DNS resolver (the server that translates domain names into IP addresses) queries a DNS record, it can also request the associated RRSIG and the public key (DNSKEY). The resolver can then verify the signature using the public key, ensuring that the data has not been tampered with.

Advantages of DNSSEC

• Data Integrity: DNSSEC ensures that the data received from a DNS query is authentic and has not been altered in transit. This protects against cache poisoning attacks where false DNS records are inserted into a resolver's cache.
• Authentication: DNSSEC provides a mechanism to authenticate the origin of the DNS data, ensuring that users are directed to the correct IP address for a domain.
• Increased Security: By adding an additional layer of security to the DNS, DNSSEC helps protect against various types of cyber attacks, enhancing overall internet security.
• Trust Establishment: DNSSEC helps establish a chain of trust, allowing users and applications to trust the DNS responses they receive.
• Protection for Users: DNSSEC helps protect end-users from phishing attacks and other malicious activities that rely on redirecting users to fraudulent websites.

DNSSEC is a crucial enhancement to the DNS that provides security through digital signatures, ensuring the authenticity and integrity of DNS data, thereby protecting users and systems from various cyber threats.

Manage DNS Security

If your domain’s DNS is hosted with a third-party nameserver provider and DNSSEC is enabled at that provider, you must also configure DNSSEC in Zoho Domains to complete the delegation process.

As the domain registrar, Zoho Domains publishes the required DS records to the domain registry. Without adding these DS records in Zoho Domains, DNSSEC validation cannot be completed—even if DNSSEC is already enabled at your DNS hosting provider.

Prerequisites

You will require certain information from your nameserver provider to set up a DS record in Zoho Domains. You will need the following information

• The Key Tag field is a short numerical value that identifies the public key used to sign the DNS zone.
• The Algorithm field identifies the cryptographic algorithm used to create the digital signature.
• The Digest Type field identifies the cryptographic hash function used to calculate the digest of the DNSKEY record
• The Digest field contains the calculated hash of the DNSKEY record

Once you have these details, you can proceed to add the DS record in Zoho Domains.

Steps to add DS record

1. Log in to the Zoho Domains account.
2. Navigate to the My Domains section from the top pane.
3. Click Manage next to the required domain.
4. Select Manage DNS on the domain management page.
5. Click DNS Security from the top pane.
6. Click Add DS Record.
7. Enter the following information provided by your nameserver provider in the respective fields:
   • Key Tag
   • Algorithm
   • Digest Type
   • Digest
8. To add additional DS records, click Add New Record.
9. Save the changes by clicking Save.

Wait for the DS record to propagate throughout the DNS system. This can take up to 24 hours.