Domain signature (DNSSEC)
Why
Below you will find some links to descriptions of some known incidents that DNSSEC probably could have prevented.
- "Cache-poisoning attack snares top Brazilian bank"
- "Eircom reveals ‘cache poisoning’ attack by hacker led to outages"
- "DNS cache poisonings foist malware attacks on Brazilians"
- "Probable Cache Poisoning of Mail Handling Domains"
- "Neither Snow Nor Rain Nor MITM... An Empirical Analysis of Email Delivery Security"
Below follows a quotation from the last mentioned research publication:
Mail security, like that of many other protocols, is intrinsically tangled with the security of DNS resolution. Rather than target the SMTP protocol, an active network attacker can spoof the DNS records of a destination mail server to redirect SMTP connections to a server under the attacker’s control. [...] We find evidence that 178,439 out of 8,860,639(2.01%) publicly accessible DNS servers provided invalid IPs or MX records for one or more of these domains.
Adoption statistics
- .nl stats and data by SIDN Labs
- DNSSEC Validation Measurement by APNIC
- DNSSEC Deployment Report
