Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm not sure if the RFC's support a IPSec-only implementation of DNS, but if it does, what does that mean for DNSSec?

Is DNSSec an IPv4-only technology?

share|improve this question

2 Answers 2

up vote 5 down vote accepted

DNSSEC provides something rather different than IPSec, and either or both may meet your needs. IPSec can encrypt packets and sign them, providing evidence that they come from something you trust, IF you have a PKI (Public Key Infrastructure) you can trust. But that "IF" is a very tall order, especially given the presence these days in most common "trusted" default certificate stores of root certificates controlled by foreign governments whom I certainly wouldn't trust.

If you just want a private VPN, using only your own certificates and networks and your own DNS servers, IPSec may provide what you want. But if you want to find out from the public network where to send your packets in the first place, i.e. via a secure mapping from domain names to IP addresses, that is what DNSSEC is for.

Note also, coming in the not-so-distant future (we hope) the almost-formed Keys In DNS (kidns) working group of the Internet Engineering Task Force, which will help integrate these and other security protocols in a way which gets around the current morass of "Certificate Authorities": http://www.spinics.net/lists/ietf-ann/msg57258.html

share|improve this answer
Related: DANE for DNS: tools.ietf.org/html/draft-ietf-dane-protocol-21 –  LamonteCristo May 24 '12 at 18:18

The DNS Section of the IPv6 Wikipedia page does not have anything about defending against bogus DNS responses so it appears that DNSSec is still necessary.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.