Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I register a domain, and update the DNS records, these changes propagate to other DNS servers around the world. But how do the servers that are accepting these changes know they can trust these changes? How can they make sure that it's not a criminal, redirecting traffic away from to their malware website by changing the DNS records?

share|improve this question

migrated from Apr 23 '13 at 5:04

This question came from our site for system and network administrators.

The simple answer is that it doesn't know who to trust. Which is the reason two possible replacements to the standard DNS system is being proposed. DNSsec is one of those possible solutions. To make a complex process simple both involve a "circle of trust" where all parties have to agree the change is actually valid. – Ramhound Apr 23 '13 at 11:06
Ramhound : DNSSEC is certainly not a "replacement" for DNS, it is an extension of it. – bortzmeyer Apr 24 '13 at 20:09
up vote 6 down vote accepted
  1. DNS Doesn't propogate the way you probably think it does. The only "propgation" is within the servers authoritative for a domain (ie, the com. TLD).
  2. Only registrars can update TLD NS and Glue records. It's tracked which registrar currently registers a domain name.
  3. There's extremely little verification of record integrity, which is why cache poisoning is possible, along with a variety of other similar attacks. DNSsec seeks to solve this issue, but adoption has been slow.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.