How can I explain a non-technical person the purpose of Domain Name System Security Extensions (DNSSEC) and the risks of not using DNSSEC? It would be nice to use a metaphor, so that it's also easy to remember for a non-technical person.

  • It might help if you provided something of your own (so we know that you aren't asking us to explain it to you ;) ) – schroeder Nov 1 '16 at 17:51
  • 2
    @schroeder fair enough, done (in the answers section)! Will you also give it a try? ;) – Bob Ortiz Nov 1 '16 at 18:03
  • 1
    This presentation: ccnso.icann.org/files/22955/… may help. It is given in many forums, but is clearly very high level, with its blue smoke. It may help to start discussing things in more details if needed. – Patrick Mevzek Jun 28 '17 at 19:57

Regular DNS responses are like business cards - while you can generally trust them when someone hands theirs to you, they're actually just ink and card stock, and anyone who is even a little motivated can get their own made by a print shop. And there's no way to enforce their validity; I can go to (for example) VistaPrint and they'll ship my "He-Man, Master of the Universe" cards right to me.

DNSSEC DNS responses are like drivers licenses. They've got a picture. They've got a mag strip with a copy of the information. They've got holographs that are difficult to forge. They've got layers printed in special ink that only show up under ultraviolet light. In short, a number of technical measures have been taken to make them hard to forge.

When authentic data is important, DNSSEC/licenses are preferred. Just as the Post Office requires a license and not a business card for identification, so your business might require DNSSEC data for use in connecting to your bank.


At the request of @schroeder (I'll also give it a shot myself).

A customer goes weekly to a local store because a friend told him that company A (who runs the store) is trustworthy. The customer does not actually know company A, he just knows the local store because the store is in his area.

One day, company A got bankrupt and a not so trustworthy company B buys the local store, continuing it's original business exactly the same as before. The customer doesn't notice a difference and keeps buying at the local store that is now owned by a not so trustworthy company B, without knowing the difference.

When the local store was protected with DNSSEC, the local store would actually notify the customer that company A changed to company B and reject the customer from entering the store.

  • 1
    For the benefit of the techies out here who may not be DNSSEC experts, can you clarify what the Store and the Company represent? I assume the Store is the website and the Company is the webserver? – Bryan Field Nov 1 '16 at 18:46
  • I think the store is the recursive DNS server whereas the company behind it is the authoritative DNS server. But I have been wrong before. Good analogy either way. – INV3NT3D Nov 1 '16 at 18:54
  • @GeorgeBailey yes, metaphorically "the store" is the registered domain and the "company" is the web server indeed. – Bob Ortiz Feb 22 '17 at 1:11
  • dnssec wouldn't really protect against this scenario. If you were to sell your DNS name to someone else (i.e. you sell the store) the new owner would also get a DNSSEC signed DNS entry. The analogy would be more like someone hijacking your entries in the yellow pages or billboards with your business name, but using a different address across town. DNS Sec is more like an ID for a business, like gowenfawr alludes to that you present to the yellow pages publishers when creating an advertisement. – Steve Sether Jun 28 '17 at 20:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.