Let's say I have my own server and I would like to tell DNS servers what web sites I host. But how would they trust me? The only one who know my real IP would be my ISP. So DNS servers should trust ISP and that's all? What about emails?

2 Answers 2


The DNS is a hierarchical system, wherein from a single root branch all sub-domains and their sub-sub-domains and so on.

The DNS of each domain is usually managed by its own DNS server. The DNS parent domain in this case has done what is called "Domain delegation", which gives an organization full authority for its own domain or sub-domain. The DNS server of the organization is then the authoritative name server for that domain.

Domain delegation means full trust - the parent does not apply censorship and the child has the full authority to mess things up, limited still only to its own domain for mapping names to IP addresses.

This is a very insecure situation, which has made it possible for a misuse of the system, sometimes by totalitarian regimes and sometimes by crooks.

The solution is Domain Name System Security Extensions (DNSSEC).

From cloudflare A Gentle Introduction to DNSSEC:

DNSSEC creates a secure domain name system by adding cryptographic signatures to existing DNS records. These digital signatures are stored in DNS name servers alongside common record types like A, AAAA, MX, CNAME, etc. By checking its associated signature, you can verify that a requested DNS record comes from its authoritative name server and wasn’t altered en-route, opposed to a fake record injected in a man-in-the-middle attack.

Most high-level DNS servers are today protected by DNSSEC.

  • that's the answer I was looking for. User1686's answer seems to imply a "circle of trust" bound by contracts at the top level and with registrars. But under, any DNS could go rogue for some time, before being "blacklisted" by other DNS and ISP. Are these correct?
    – ceillac
    Jan 14 at 16:01
  • I'm asking this question because I'm trying to imagine if this hierarchy could be disturb. By creating new connections and contracts with some chosen DNS and ISP.
    – ceillac
    Jan 14 at 16:06
  • 1
    There is no blacklisting in DNS. Each (sub)domain is authoritative in its area. The hierarchy can only be disturbed by a trusted high-level publishing that it's authoritative for a domain other than its own. Actually Russia did just some time ago and got a look at an unknown number of emails, but it's Russia that needed to desist (no internet police). The system is truly a distributed database system, so vulnerable without DNSSEC.
    – harrymc
    Jan 14 at 16:33
  • if I'm a ISP and I know a DNS misbehaving then I would blacklist it. Same if I was a DNS. I don't understand your statement. As for disrupting a hierarchy, if you offer DNS money in exchange for registering locally your own domain why wouldn't they do it? Then if there's enough money and participants maybe it could disrupt the hierarchy
    – ceillac
    Jan 14 at 17:26
  • 1
    @ceillac: Not sure what you mean by "a DNS". There is generally no such entity referred to as "a DNS" on the Internet. Are you talking about TLD registries? The registrars that provide information to registries? The public DNS resolvers? The TLD registries themselves run the authoritative DNS servers for that TLD, so they're already getting the same money for registrations anyway (indirectly, from registrars).
    – user1686
    Jan 17 at 5:40

DNS doesn't care about whether it's "your real IP". You can just point the domain name at any address and nobody will stop you.

Generally domain lookups are done in the direction "domain ⇒ address", not the other way around, so what matters is whether the domain name belongs to you. Its ownership is managed when you "purchase" the domain through a registrar (which has contracts with the registries that manage each TLD) – then you use your account on the registrar's website to specify (sub)domain IP addresses, or to point the whole domain at your own DNS servers.

Email and web work the same way – whether someone is sending mail to your domain, or visiting a website at your domain, it's still managed by the domain's owner (just using different DNS record types).

(TLS certificates, too, only bind the domain name with your servers, not the IP address – so the issuing CA will ask you to prove domain name ownership by adding special DNS records.)

  • I'm trying to understand how the map "domain names <=> IP addresses" is controlled so a connection to a website is not hijacked. From your answer I am guessing TLD tell their DNS servers which address corresponds to a name. Is this correct?
    – ceillac
    Jan 14 at 9:05
  • @ceillac: Well, again, it's just "=>", not "<=>", because nobody cares about the reverse mapping, only the 'forward' mapping needs to be controlled. The registrar submits information like "domain X is managed via registrar Y" to the TLD registry (and the registry trusts it due to a signed contract), and then only your account at that registrar is allowed to make changes to the "domain=>IP" mappings because the registrar knows you're paying for that domain.
    – user1686
    Jan 14 at 9:19
  • I got that, my question was: DNS trust the TLD? but there must be some kind of control
    – ceillac
    Jan 14 at 10:00
  • Control for what exactly?
    – user1686
    Jan 14 at 11:22
  • When you register a domain, you define (in whois record) what your Name Server(s) is for that FQDN and Root NSs all just point queries there (where the resource records - i.e. A/AAAA records with IP addresses are). I could be corrected, but I believe most DNS hijacking involves fooling your system into querying their server for an answer instead of Root, TLD, or the Authoritative NSs.
    – Dallas
    Jan 14 at 15:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.