7

Recently, I've been reading about DNSSEC and how it works. I found other questions and some very interesting answers on this and other websites related to this matter.

However, I have a question to which I couldn't find an answer anywhere: how can a client know that a DNS zone is supposed to be signed? If machineA never resolved the name example.com, how can DNSSEC prevent an attacker from intercepting the DNS query leaving machineA and replying to that query with a well-formed DNS reply holding a malicious IP address, but which seems to to come from the resolver?

In other words, I can't understand how DNSSEC prevents Man In The Middle Attacks. If the host never resolved the name before, how can it know that the reply is supposed to be signed?

I understand how DNSSEC can protect against cache poisoning, and how the integrity of the messages is assured, but it all seems to fall apart if someone simply sits between the user's machine and the resolver to strip out dnssec information.

Improve this question
2

2 Answers 2

Reset to default
3

DNSSec does not prevent against MITM attacks. This is also mentioned in the following answer and a bit more explanation of how DNSSec works and some of its limitations.

In this paper author discusses ways to circumvent DNSSec in Section VI, including 'intruder-in-the-middle' attack.

Improve this answer
3
  • 2
    This is incorrect - DNSSEC does protect against MITM attacks (Against DNS at least, which is where it is implemented).
    – ConnorJC
    Aug 12, 2016 at 19:09
  • This answer is wrong.
    – R.. GitHub STOP HELPING ICE
    Jun 22, 2021 at 22:01
  • This answer is wrong AND is not an answer at all the question (it just links to other pages, without explanations on how they relate to the question asked here).
    – Patrick Mevzek
    Sep 4, 2023 at 18:55
1

DNSSEC requires cryptographic proof that a zone is not protected in order to accept unsigned results for it. This takes the form of signed NSEC or NSEC3 records in the parent zone indicating the absence of DS records for the delegation.

If as the client you don't actually validate the signature chain, but just trust your nameserver, then there is still the possibility of MITM attack. Secure use of DNSSEC requires validation on your local endpoint by a trusted process. Modern consensus is that this does not belong in the individual application process but in a trusted caching and validating nameserver running on localhost, or similar.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .