DNSSEC helps mitigate which type of attacks?

DNSSEC helps mitigate which type of attacks?

• A. DNS poisoning and spoofing
• B. Man-in-the-middle on SSL
• C. Phishing via email spoofing
• D. Botnet DDoS

Answer: (A)

DNSSEC adds cryptographic signatures to DNS data so that each piece of DNS information can be verified as authentic and unmodified by the resolver. When a resolver receives a DNS response, it uses the signatures and the chain of trust from DNSKEY records to confirm that the data came from the true source. If an attacker tries to poison a DNS cache or spoof records to redirect users to a malicious site, the forged data won’t validate, and the resolver will reject it. That’s how DNSSEC mitigates DNS poisoning and spoofing. It doesn’t encrypt DNS traffic, so it won’t protect against MITM on SSL, nor does it directly stop email spoofing or botnet-driven DDoS.

DNSSEC adds cryptographic signatures to DNS data so that each piece of DNS information can be verified as authentic and unmodified by the resolver. When a resolver receives a DNS response, it uses the signatures and the chain of trust from DNSKEY records to confirm that the data came from the true source. If an attacker tries to poison a DNS cache or spoof records to redirect users to a malicious site, the forged data won’t validate, and the resolver will reject it. That’s how DNSSEC mitigates DNS poisoning and spoofing. It doesn’t encrypt DNS traffic, so it won’t protect against MITM on SSL, nor does it directly stop email spoofing or botnet-driven DDoS.