All 7 Amazon Route 53 & DNS Management questions
More in Amazon Route 53 & DNS Management
What is a Route 53 alias record, and how is it different from a standard CNAME record? How do Route 53 routing policies, such as weighted and latency based routing, affect how traffic is directed? What are Route 53 health checks, and how do they support failover routing? How does Route 53 Resolver enable DNS resolution between a VPC and on premises networks?
Advertisement
Back to results for “Security”
AWS › Amazon Route 53 & DNS Management

What is DNSSEC, and how does Route 53 support it to protect against DNS spoofing?

Advanced

Answer

DNSSEC, or Domain Name System Security Extensions, adds a layer of cryptographic signatures to DNS responses, allowing resolvers to verify that the DNS data they receive has not been tampered with or spoofed by an attacker, and Route 53 supports enabling DNSSEC signing for hosted zones, which helps protect users of your domain from certain man in the middle style DNS attacks.
aws route53 enable-hosted-zone-dnssec --hosted-zone-id ABC123
Real-world example A financial institution enables DNSSEC on its domain hosted in Route 53 to provide an additional layer of trust and protection against attackers attempting to redirect its customers to a fraudulent, spoofed version of its website.

Common follow-ups: What are the operational complexities involved in managing DNSSEC key rotation?;Does enabling DNSSEC affect DNS query performance?

AWS KMS & Data Encryption;AWS Security Hub & GuardDuty
All 7 Amazon Route 53 & DNS Management questions