Theoretically, DNS cache poisoning shouldn't matter,because everything important is protected by SSL and IPsec.

  • So why DNSSec was developed?
  • Aren't the first two protocols sufficient?

SSL and TLS provide transport security, but after DNS resolving. So if the DNS cache has been poisoned the connection will go to the wrong server.

But after the connection has been made and the TTL of the DNS is ie. a day and then the dns poisoning takes place this has no effect anymore, because the client will do no dns resolving (because he already knows where to connect to...).

|improve this answer|||||
  • 2
    SSL and TLS use certificates to verify the identity of the other party. So although they do not protect against cache poisoning itself, the certificates help to protect against the results. – S.L. Barth - Reinstate Monica Jan 25 '15 at 16:02

The two technologies are designed for different applications.

IPsec isn't traditionally used across the Internet, but rather on local networks. It also requires networking infrastructure that supports IPsec, which isn't common in SOHO routers and other non-enterprise equipment.

DNSSEC works across the Internet, and is designed to provide a form of PKI for DNS. It doesn't provide transport security, but it does help prevent DNS hijacking.

|improve this answer|||||
  • SSL (or TLS), providing transport security, does it already prevent DNS hijacking? This is my personal doubt. – Black Jan 25 '15 at 11:21
  • @Polynomial, Re "IPsec isn't traditionally used across the Internet", but it can be, isn't it? So why did we choose to deploy DNSSEC instead of simply deploying IPSEC? – Pacerier Nov 4 '17 at 5:24
  • @Pacerier IPsec isn't suitable for mass implementation across the internet. It would massively complicate load balancing, routing, and many other areas of network administration. DNSSEC has significant problems and is far from being chosen for mass deployment. In fact, many major internet organisations are dropping it because it is so flawed. A better approach is DANE, which involves restructuring PKI entirely, but that isn't fantastic either. – Polynomial Nov 6 '17 at 14:49
  • @Black TLS does not prevent you from hijacking DNS to point the IP somewhere else, but you still need to forge the certificate in order to man-in-the-middle the comms anyway, so DNSSEC or IPsec wouldn't offer any additional protection over TLS in that regard. – Polynomial Nov 6 '17 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.