How does my OS or browser knows to check for DNSSEC? How does the verification process works? Do I need a key from Comodo/Verisign? Do I need to install something to my hosting? What happens in men in middle attack? I have a man in middle attack case; the Turkish DNS providers show a page for my web site with "this site is blocked". Do all modern browsers support DNSSEC?

  • 1
    There are a lot of questions here and many answers to them are available online. Can you narrow down your question and include what research you've done?
    – schroeder
    Commented Nov 7, 2015 at 0:03
  • @schroeder, dnssec-name-and-shame.com says that nlnetlabs.nl uses DNSSEC but I cannot see any advantage of it. I have changed the web site's IP address from my hosts file and when I visit the page again my browser does not notify me that this is a fake site. So, DNSSEC is completely useless to end user.
    – ilhan
    Commented Nov 7, 2015 at 0:11
  • Are you certain your Web site hasn't been hacked? Perhaps dns is working but your site is messed up. Commented Nov 7, 2015 at 0:42
  • @NeilSmithline, my web site works if I use non-Turkish DNS. And here engelliweb.com/url/odtu-lu it says that the www.odtu.lu is blocked by court order.
    – ilhan
    Commented Nov 7, 2015 at 0:58
  • This appears to be a classic X/Y problem.
    – schroeder
    Commented Nov 7, 2015 at 5:29

1 Answer 1


Answering this questions all at once is somewhat outside the scope of a question and answer site. I will provide you some insight:

DNSSEC secures the DNS data of a server, meaning that when your browser tries to connect a server, it needs to look up it's IP-address. This IP-address is queried via the DNS servers configured in your OS (Google provides some under and Useally your system will use the DNS resolver your ISP (Internet service provider) provides.

Since a domain owner did not instruct your ISP's DNS resolver directly, it will query an authoritative name server for that domain (NS). How do you know for example that your ISP didn't change the IP-address of the website you're trying to access? That's where DNSSEC kicks in!

Every domain (e.g. .com, .net, .org) is inside the DNS root zone. In the root zone are (public) keys provided by the operators of those subzones (e.g. .com). In case of .com it's VeriSign*. In the DNS .com zone are than keys for each individual domain if it supports DNSSEC.

Let's say you have your domain example.com at Namecheap and enabled DNSSEC. The DNS record is first fetched from Namecheap's NS servers, which singned the record. Your browser can check now if the record is valid according to that key and than go one level up in the chain to see if your key for example.com is found in the zone .com. The zone .com is signed by a key found in the DNS root zone, which is maintained by the ICANN.

Different to classic TLS/SSL you don't need a certification authority (CA) like COMODO, since every record is traced back to the DNS root zone. What you need instead is a domain registrar (Namecheap, GoDaddy) that supports DNSSEC and a domain that supports DNSSEC, since not every domain supports (therefor has keys in the root zone) like for example .com does.

Modern browsers don't have DNSSEC checks enabled by default. Hopefully that changes in the future. However this does not mean that DNSSEC provides no security, since your ISP's dns servers will likely check wherever the records it got are valid and if not not resolve the domain name into an IP-address.

*Confusing example since VeriSign is both a classic CA and operates domain zones.

  • To be noted; Well my ISP's DNS servers are hijackers. See this dergiweb.com/inc/rDA/N/… Youtube was blocked in Turkey. Currently over 30000 known domains are blocked by ISPs.
    – ilhan
    Commented Nov 7, 2015 at 0:53
  • 1
    I would suggest using trusted DNS servers than (I mentioned the ones from Google, which support DNSSEC). This does not stop them from intercepting and faking the packets though. I don't know if that helps in the case of your country. You can enable pseudo DNSSEC support with addons. dnssec-validator.cz You could also run your own DNS server which will check the records for you, but that means if the lookup fails you cannot access the site. Also your country might as well use DPI to inject things into the traffic without spoofing the IP (Solution: HTTPS).
    – K.A.B.
    Commented Nov 7, 2015 at 1:04
  • 2
    +You might consider using a VPN.
    – K.A.B.
    Commented Nov 7, 2015 at 1:07
  • To be noted; Yes, DPI exists because of PHORM (Gezinti). You visit a regular http web site and it redirects to gezinti.com. Ask for your permission to collect data about you (if you say no it ask again a week late until you accept). Then with DPI it collects data. Also when you exceed your quote it can show alert web page in stackoberflow.com. Yes it happens.
    – ilhan
    Commented Nov 7, 2015 at 9:05
  • Verisign sold their CA business in 2010 to Symantec, which has been gradually rebranding it -- although they also acquired GeoTrust and Thawte and continue to operate those under the original names. Verisign now does DNS and little else. Whether that's still confusing I do not say. Commented Nov 10, 2015 at 16:44

Not the answer you're looking for? Browse other questions tagged .