This key just digitally signs each record set in the zone while the public portion DNS key verifies the signature itself. Then in terms of keys, we have the Zone Signing Key, which is the private portion of the key. This can be used by resolvers to verify the nonexistence of a record name and type. Resolvers can verify the signature with a public key stored in the DNS key record that we just mentioned. These RRSIG records hold the DNSSEC signature for record set. Then we have the DNS key record, which holds the public key that resolvers can use to verify the DNSSEC signatures in the RRSIG records. We also reference to this record as the chain of trust. It's used to secure delegations between nameservers. These are the record and key types used by DNSSEC, which I will be referencing later on. This protocol provides cryptographic authentication of data, authenticate the denial of existence, and data integrity, but not availability or confidentiality. What is DNSSEC? DNSSEC is a suite of extensions intended for securing data exchanged by the DNS protocol.
Our team looks after ingress load balancing, TLS, DNS, CDNs, and DDoS protection at Slack, among other things. I'm a senior software engineer on the traffic team at Slack. Tellez: In this presentation, we are going to talk about Slack's DNSSEC rollout and a very interesting outage that we had on September 30th last year.
0 kommentar(er)
