DNSSEC helps mitigate which type of vulnerability?

DNSSEC helps mitigate which type of vulnerability?

• A. DNS poisoning and spoofing
• B. Man-in-the-middle on TLS
• C. DDoS
• D. Phishing

Answer: (A)

DNSSEC provides data integrity and origin authentication for DNS responses by signing DNS data and chaining trust from the root down to each zone. This makes it practically impossible for an attacker to deliver forged or tampered DNS answers that redirect users to a malicious site. When a resolver receives a DNS response, it validates the accompanying signatures (RRSIG) against the zone’s public keys (DNSKEY) and the parent zone’s DS records; if the signatures don’t verify, the response is rejected. By ensuring that the information about which IP a domain should resolve to is authentic, DNSSEC mitigates DNS poisoning and spoofing. It doesn’t encrypt the connection or prevent TLS-level man-in-the-middle attacks, and it doesn’t directly address DDoS or phishing. DNSSEC’s protection lies in authenticating DNS data so users aren’t steered by forged DNS responses.

DNSSEC provides data integrity and origin authentication for DNS responses by signing DNS data and chaining trust from the root down to each zone. This makes it practically impossible for an attacker to deliver forged or tampered DNS answers that redirect users to a malicious site. When a resolver receives a DNS response, it validates the accompanying signatures (RRSIG) against the zone’s public keys (DNSKEY) and the parent zone’s DS records; if the signatures don’t verify, the response is rejected. By ensuring that the information about which IP a domain should resolve to is authentic, DNSSEC mitigates DNS poisoning and spoofing.

It doesn’t encrypt the connection or prevent TLS-level man-in-the-middle attacks, and it doesn’t directly address DDoS or phishing. DNSSEC’s protection lies in authenticating DNS data so users aren’t steered by forged DNS responses.