Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

With the recent conspiracy theories around the registrar MarkMonitor Inc., the question arises, if DNSSEC protects against a registrar going malicious (or being attacked).

This is especially interesting in the context of SSL certificates. At the moment any trusted certification authority can sign any server certificate. There is a proposal, which suggests, to store the signatures in DNS instead. This is a good idea, because it reduces the number of weak links, that are able to issue malicious certificates. But it puts access to the DNS servers for name resolution and key distribution in one central place.

share|improve this question
up vote 9 down vote accepted

No. DNSSEC does not protect the integrity of a DNS name if the registrar for that name is malicious (or compromised). The registrar for is the ultimate source of authority for who owns (and, e.g., what is the public key for Consequently, if the registrar is malicious or compromised, then the registrar can transfer control or otherwise subvert security.

That said, I believe the situation is not quite as bad as you feared (it is not the case that any registrar anywhere can compromise every DNS name in existence). For instance, as far as I know, some random registrar cannot take control of every domain name under .com.

Here's my understanding of how it works. Today, Verisign administers .com. That means that Verisign totally controls .com, and has the DNSSEC signing keys that lets it create arbitrary records for names. There's a long list of domain registrars, who can all register domain names under .com. The way that works is that the registrar interacts with Verisign to request that some name (say, be assigned to it; Verisign confirms that no one already owns, then assigns it to the registrar and keeps a record of this assignment. Transferring domains between registrars happens similarly.

Let's say you own some valuable domain name under .com (say, Who are your DNSSEC records vulnerable to? They are vulnerable to Verisign, and to your registrar. I don't believe you are vulnerable to any other registrar, assuming that the domain transfer process is adequately secured. Caveat: the domain transfer process is beyond the scope of DNSSEC, but it is a significant potential point of vulnerability in practice.

share|improve this answer
That's correct. Registrar can submit DS records only for domains under his control, and registrar can take over domain registered via other registrar only after ownership verification process. – Sandman4 Jun 24 '12 at 11:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.