2

When I register a domain, and update the DNS records, these changes propagate to other DNS servers around the world. But how do the servers that are accepting these changes know they can trust these changes? How can they make sure that it's not a criminal, redirecting traffic away from example.com to their malware website by changing the DNS records?

Improve this question
2
  • The simple answer is that it doesn't know who to trust. Which is the reason two possible replacements to the standard DNS system is being proposed. DNSsec is one of those possible solutions. To make a complex process simple both involve a "circle of trust" where all parties have to agree the change is actually valid.
    – Ramhound
    Apr 23, 2013 at 11:06
  • Ramhound : DNSSEC is certainly not a "replacement" for DNS, it is an extension of it.
    – bortzmeyer
    Apr 24, 2013 at 20:09

1 Answer 1

Reset to default
6
  1. DNS Doesn't propogate the way you probably think it does. The only "propgation" is within the servers authoritative for a domain (ie, the com. TLD).
  2. Only registrars can update TLD NS and Glue records. It's tracked which registrar currently registers a domain name.
  3. There's extremely little verification of record integrity, which is why cache poisoning is possible, along with a variety of other similar attacks. DNSsec seeks to solve this issue, but adoption has been slow.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .