Changes

=='''Domain Name System Security Extensions'''==

'''Domain Name System Security Extensions'''

The '''Domain Name System Security Extensions''' is a set of [[DNS]] extensions which enables communication authentication between hosts and DNS data, while ensuring data integrity. The DNSSEC is used for securing specific information provided by [[DNS]].

The '''Domain Name System Security Extensions''' is a set of [[DNS]] extensions which enables communication authentication between hosts and DNS data, while ensuring data integrity. The DNSSEC is used for securing specific information provided by [[DNS]].

===Short Overview===

 

==Short Overview==

The DNSSEC is generally referred to as DNS Security Extensions. Its main goal is to protect against data spoofing and corruption. At first, it was called only [[DNS]](Domain Name System) and did not include security extensions. The main DNSSEC extensions are specified by RFC4033, RFC4034, and RFC4035. There are also some additional RFCs which provide supporting information.  

The DNSSEC is generally referred to as DNS Security Extensions. Its main goal is to protect against data spoofing and corruption. At first, it was called only [[DNS]](Domain Name System) and did not include security extensions. The main DNSSEC extensions are specified by RFC4033, RFC4034, and RFC4035. There are also some additional RFCs which provide supporting information.  

Apart from the new DNS server and client concepts,DNSSEC introduces to DNS the following 4 new resource records: DNSKEY, RRSIG, NSEC and DS. In order to deploy DNSSEC on Windows Server® 2008 R2 or Windows® 7 operating systems there are various guides to follow. Windows Server® 2008 R2 and Windows® 7 operating systems.

Apart from the new DNS server and client concepts,DNSSEC introduces to DNS the following 4 new resource records: DNSKEY, RRSIG, NSEC and DS. In order to deploy DNSSEC on Windows Server® 2008 R2 or Windows® 7 operating systems there are various guides to follow. Windows Server® 2008 R2 and Windows® 7 operating systems.

===How it works===

==How it works==

The DNS was initially developed to without any security extensions, thus increasing the chances for forget over the Internet and allowing the spoofing of IP Addresses with the purpose of redirecting traffic to undesired websites. This is how DNSSEC appeared: as a need for adding protection and security to DNS so that the redirected traffic could be checked and directed towards the right server.  

The DNS was initially developed to without any security extensions, thus increasing the chances for forget over the Internet and allowing the spoofing of IP Addresses with the purpose of redirecting traffic to undesired websites. This is how DNSSEC appeared: as a need for adding protection and security to DNS so that the redirected traffic could be checked and directed towards the right server.  

If the DNSSEC authentication does not work (case in which the encryption keys are not matches), due to the backwards-compatible system, the transaction will follow the DNS protocols.

If the DNSSEC authentication does not work (case in which the encryption keys are not matches), due to the backwards-compatible system, the transaction will follow the DNS protocols.

===Objectives===

==Objectives==

The core objectives of DNSSEC are:  

The core objectives of DNSSEC are:  

* Origin authority

* Origin authority

The DNSSEC mechanism of authentication of communication between hosts fulfilled by means of TSIG. More specifically, the TSIG is used to securely authenticate the transactions between the name servers and the resolver. The DNSSEC mechanism of establishing authenticity and data integrity is achieved by means of: new RRs, singning a single zone,building a trust chain and by means of key rollers or key exchange.  

The DNSSEC mechanism of authentication of communication between hosts fulfilled by means of TSIG. More specifically, the TSIG is used to securely authenticate the transactions between the name servers and the resolver. The DNSSEC mechanism of establishing authenticity and data integrity is achieved by means of: new RRs, singning a single zone,building a trust chain and by means of key rollers or key exchange.  

===DNSSEC Difficulties===

==DNSSEC Difficulties==

It is critically important to secure the DNS for ensuring overall Internet protection, but when it comes to the deployment of DNSSEC the following difficulties are encountered:

It is critically important to secure the DNS for ensuring overall Internet protection, but when it comes to the deployment of DNSSEC the following difficulties are encountered:

# A lot of work over the Internet in order to create a well developed backward-compatible system and standards

# A lot of work over the Internet in order to create a well developed backward-compatible system and standards

#Conflicts among implementers related to ownership issues of the root encryption keys

#Conflicts among implementers related to ownership issues of the root encryption keys

===DNSSEC Standards===

==DNSSEC Standards==

* RFC 2181 Clarifications to the DNS Specification

* RFC 2181 Clarifications to the DNS Specification

* RFC 2535 Domain Name System Security Extensions

* RFC 2535 Domain Name System Security Extensions