↳If an attacker intercepts your UDP DNS request (which is unencrypted text), they can reply with google.com = 192.168.1.99 (their malicious server).
↳This is called DNS spoofing or cache poisoning.
DNSSEC (DNS Security Extensions)
↳fixes this by cryptographically signing DNS records.
↳The authoritative nameserver holds a private key and signs the A record.
↳The resolver verifies the signature using a public key published in the DNS zone.
↳The trust chain goes all the way up to the Root Zone.
The Danger
↳If you enable DNSSEC and mess up your key rotation, or if the signature expires, resolvers will treat your domain as compromised and refuse to resolve it.
↳Slack suffered a massive outage in 2021 because of a DNSSEC failure.
↳If you don't fully understand it, don't turn it on.
▲ LIVE INCIDENTA domain was migrated to a new registrar yesterday. Some users see the new site, some see the old site.