Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
DNSSEC security starts by first grouping DNS records (RR) of the same type into a record set (RRset) and then this RRset gets signed...
Does this mean that I have to completely define all the RR in my DNS prior to enabling DNSSEC? What would happen if I added some DANE TLSA records after DANE was already enabled?
What you suggest would be rather silly, wouldn't it? It would mean that you would have to disable DNSSEC every time you make any modification to your zone, which would both be very laborious and leave your zone unprotected for a long time (for the TTL on the parent zone).
When you enable DNSSEC, the parent zone adds DS records authorizing your DNSKEY to sign the records in your zone. When you change a RRset you simply sign it again with your key, resulting in a new RRSIG.
Furthermore, RRSIG records have Signature Validity Periods (RFC 6781, 4.4.2); you must resign the RRset before it expires. It's better automate this! Also, until the validity period expires, it would be possible to use the old RRSIG to sign an old RRset and perform a replay attack. It's all explained in detail in the RFC.
