MailShield Docs

Appearance

DNSSEC (DNS Security Extensions) ​

DNSSEC adds cryptographic signatures to DNS responses, ensuring they haven't been tampered with and come from the authoritative source.

How DNSSEC Works ​

The Problem ​

Standard DNS has no authentication:

  • Responses can be forged
  • Cache poisoning attacks possible
  • Man-in-the-middle DNS attacks
  • No way to verify response authenticity

The Solution ​

DNSSEC adds digital signatures to DNS:

  1. Zone signing: DNS records are signed with private keys
  2. Public keys in DNS: Public keys published in DNS
  3. Chain of trust: Signatures verified up to root
  4. Validation: Resolvers verify signatures
Root Zone (.)
    │ Signed with the root key
    │ Holds a DS record for .com
    ▼
TLD Zone (.com)
    │ Signed with the .com key
    │ Holds a DS record for example.com
    ▼
Your Zone (example.com)
    │ Signed with your key
    ▼
DNS Records
    Signed with your zone key

Each parent zone publishes a DS record for its child: a hash of the child's key-signing key. That's how a resolver knows which key to trust for your zone.

DNSSEC Record Types ​

DNSKEY ​

Contains the public keys for the zone:

example.com.  DNSKEY  256 3 13 (key data...)
example.com.  DNSKEY  257 3 13 (key data...)

Key types:

  • 256 (ZSK): Zone Signing Key - signs records
  • 257 (KSK): Key Signing Key - signs DNSKEY records

DS (Delegation Signer) ​

Links your zone to its parent. It holds a hash of your zone's key-signing key (KSK):

example.com.  DS  12345 13 2 (hash of example.com's KSK)

It's published in the parent zone (.com for example.com). You don't add it to your own zone: your registrar submits it to the parent.

RRSIG ​

Signature over a set of records:

example.com.  RRSIG  A 13 2 300 (signature data...)

Every record type has corresponding RRSIG records.

NSEC/NSEC3 ​

Proves non-existence of records:

example.com.  NSEC  mail.example.com. A MX TXT RRSIG NSEC

Chain of Trust ​

DNSSEC validation follows the chain:

1. Root Zone
   └── Root DNSKEY (trust anchor)
   └── Signs .com DS record

2. .com Zone
   └── .com DNSKEY (verified by root)
   └── Signs example.com DS record

3. example.com Zone
   └── example.com DNSKEY (verified by .com)
   └── Signs all records in zone

4. DNS Records
   └── A, MX, TXT, etc. (verified by zone key)

If any link breaks, validation fails.

Why DNSSEC Matters for Email ​

Protects Email Authentication ​

DNSSEC secures the DNS records that email security depends on:

  • SPF records
  • DKIM public keys
  • DMARC policies
  • MX records

Prevents DNS Attacks ​

Without DNSSEC, attackers could:

  • Forge SPF to authorize malicious senders
  • Replace DKIM keys
  • Modify DMARC policies
  • Redirect MX to malicious servers

Enables DANE ​

DANE (DNS-based Authentication of Named Entities) requires DNSSEC:

  • Pins TLS certificates in DNS
  • Provides additional transport security
  • Only works with DNSSEC validation

Enabling DNSSEC ​

Step 1: Check Registrar Support ​

Your domain registrar must support DNSSEC. Most major registrars do, including GoDaddy, Namecheap, Cloudflare and Amazon Route 53.

Step 2: Enable at DNS Provider ​

If using a DNS provider (not registrar DNS):

  1. Enable DNSSEC in DNS provider settings
  2. Get DS record from DNS provider
  3. Add DS record at registrar

Step 3: If Using Registrar DNS ​

Many registrars handle this automatically:

  1. Find DNSSEC settings in registrar dashboard
  2. Enable DNSSEC with one click
  3. Registrar handles key generation and DS record

Step 4: Verify ​

After enabling:

  1. Wait for propagation (up to 48 hours)
  2. Test with DNSSEC analyzers
  3. Verify chain of trust

Verification ​

Check DNSSEC Status ​

Using delv (ships with BIND, validates the full chain itself):

bash
delv example.com
# "; fully validated" means the chain of trust checks out

Using dig:

bash
dig +dnssec example.com
# Look for the 'ad' (Authenticated Data) flag. It only appears
# if the resolver you query validates DNSSEC.

Online tools:

  • DNSViz (dnsviz.net)
  • Verisign DNSSEC Debugger
  • MXToolbox DNSSEC Check
  • MailShield DNSSEC validation

Chain Validation ​

A valid chain shows:

. (root) → .com → example.com
    ✓         ✓         ✓

Common Issues ​

Broken Chain ​

Symptoms:

  • DNSSEC validation fails
  • SERVFAIL responses

Causes:

  • Missing DS record at registrar
  • Expired signatures
  • Key mismatch between provider and registrar

Solution:

  • Verify DS record matches current DNSKEY
  • Re-sync DS record with registrar
  • Check with DNS provider

Expired Signatures ​

Symptoms:

  • Validation fails after working
  • RRSIG expiration date passed

Causes:

  • DNS provider not re-signing
  • Zone not being updated

Solution:

  • Contact DNS provider
  • Verify zone signing is active

Key Rollover Issues ​

Symptoms:

  • Validation fails during key change
  • DS record doesn't match DNSKEY

Causes:

  • DS record not updated after key rollover
  • Timing issues during rollover

Solution:

  • Follow proper key rollover procedures
  • Update DS record before removing old key

DNSSEC at Common DNS Providers ​

Cloudflare ​

  • One-click DNSSEC enable
  • Automatic key management
  • DS record provided for registrar

AWS Route 53 ​

  • Enable DNSSEC signing
  • Key management via KMS
  • DS record for registrar

Google Cloud DNS ​

  • DNSSEC available
  • Managed signing
  • DS record export

DANE Integration ​

With DNSSEC enabled, you can use DANE:

TLSA Records ​

_25._tcp.mail.example.com.  TLSA  3 1 1 (certificate hash)

Benefits:

  • Pin TLS certificates in DNS
  • Additional transport security
  • Prevents certificate misissuance attacks

DANE and MX ​

DANE can secure:

  • Connections to your MX servers
  • Certificate validation via DNS
  • Requires DNSSEC on MX hostnames

Best Practices ​

Do ​

✅ Enable DNSSEC at both registrar and DNS provider
✅ Verify chain of trust after enabling
✅ Monitor for signature expiration
✅ Test after any DNS changes
✅ Keep DS record in sync \

Don't ​

❌ Enable without understanding key management
❌ Ignore validation failures
❌ Forget to update DS after key rollover
❌ Disable without removing DS record first

MailShield DNSSEC Features ​

Checks → DNSSEC shows, for each domain:

  1. DNSSEC Enabled: is the domain signed?
  2. Chain Valid: does the chain of trust from the root hold?
  3. DS Records: how many DS records the parent zone publishes for you

With DNS changes alerts on, MailShield tells you when DNSSEC is turned off or stops validating.

Security Score Impact ​

DNSSEC that's enabled and validates earns 10 points (domains that send and receive mail, and parked domains) or 15 points (domains that only send or only receive). Missing or broken DNSSEC earns 0. See Security Score.

Troubleshooting Commands ​

Check DNSSEC with dig ​

bash
# Check if DNSSEC is enabled
dig +dnssec example.com

# Check DS record
dig DS example.com

# Check DNSKEY
dig DNSKEY example.com

# Full validation (dig +sigchase no longer exists; use delv)
delv example.com

Online Tools ​

  • DNSViz: Visual DNSSEC chain analysis
  • Verisign DNSSEC Debugger: Step-by-step validation
  • delv: Command-line validation, included with BIND

Monitor and secure your email domains.

Copyright © 2026 MailShield