DNSSEC es una característica del Sistema de nombres de dominio (DNS) que autentica las respuestas a las búsquedas de nombres de dominio. Impide que los atacantes manipulen o envenenen las respuestas a las solicitudes de DNS. La tecnología DNS no se diseñó teniendo en cuenta la seguridad. Un ejemplo de un ataque a la infraestructura DNS es falsificación de DNS . En ese caso, un atacante secuestra la memoria caché de un solucionador DNS, lo que hace que los usuarios que visitan un sitio web reciban una dirección IP incorrecta y vean el sitio malicioso del atacante en lugar del que pretendían.
Los servicios de administración de DNSSEC son parte de nuestros planes de alojamiento de DNS: DNS Premium, DNS Protegido de DDoS y GeoDNS. ¡Sin costo adicional para una mejor seguridad!
Premium S $2.95/Mes |
Premium M $4.95/Mes |
Premium L $14.95/Mes |
|
---|---|---|---|
? DNS Anycast Gestionado con DNSSEC: | |||
? Zonas DNS: | 5 | 50 | 400 |
? DNS registros: | 200 | 2,000 | 20,000 |
? Consultas DNS por mes: | i 5M | i 200M | Ilimitado |
? Redirección de correo: | 10 | 100 | 1,000 |
? DNS Failover comprobaciones: | 1 | 2 | 3 |
Prueba completamente gratis. No se requieren tarjetas de crédito. Sin trucos. |
When you activate DNSSEC, we'll generate a public-private key pair for your zone. The public key, provided as DS or DNSKEY records, should be configured with your domain provider. Our network will use the private key to sign your records during zone deployment. The end-user resolver checks these signatures against the public keys to authenticate record integrity during transfer.
DNSSEC aims to enhance user safety by verifying digital signatures after a user enters a domain name. Information can only reach the user's device when digital signatures match between the data and the Primary DNS server, ensuring connection to a legitimate website. It utilizes digital signatures and public keys to validate information, adding new records to existing DNS entries like A, CNAME, and MX. DNSKEY and RRSIG digitally sign DNS data using public-key cryptography. Each DNS zone's name server holds public and private keys. When a user queries, the server provides information signed with its private key, which the recipient opens with the public key. If information is modified, it won't open correctly, triggering an error message.
Simplemente haga clic en el botón de activación en el panel de control, y nuestro sistema asegurará la zona. Solo se le pedirá que agregue los registros DS en el proveedor, y la configuración se completará.
Estamos utilizando el algoritmo de curva elíptica (ECDSA P-256) para todas las firmas, que es más fuerte y más pequeño que las claves RSA estándar.
¡Mantener las respuestas DNS lo más pequeñas posible significa una velocidad más rápida para usted! Además, nuestra red DNS Anycast proporciona respuestas más rápidas desde la ubicación más cercana al solucionador.
No importa qué día, no importa cuándo, proporcionamos monitoreo y soporte de red continuo e ininterrumpido. Nuestro equipo de soporte técnico está en línea para usted 24/7 por chat en vivo y tickets. Podemos migrar sus zonas de forma gratuita, lea más aquí.
To activate DNSSEC signing and obtain the domain DS records and DNSKEY records, you need to process the following steps:
Optional: For additional details and guidance about DNSSEC implementation, refer to the ClouDNS DNSSEC wiki page.
When you want to connect to a particular website, your browser should get the corresponding IP address. Unfortunately, there is a chance an attacker to intercept your DNS queries and place fake information. As a result, your browser will connect to a forged website where you could potentially enter personal information, like bank details.
Thanks to DNSSEC, there is an additional level of security, and your browser is able to check if the DNS data is actually correct and not changed. In addition, DNSSEC is used not only for the web but also by any other Internet service or protocol, for instance, SMTP and Voice-over- IP (VoIP).
With DNSSEC, you can protect your domain from vulnerabilities like:
Domains with enabled DNSSEC offer cryptographic security, ensuring authentic DNS data and protecting users from attacks and traffic interception. They safeguard brands from DNS hijacking and reputation damage. In contrast, domains without DNSSEC lack this protection, making them more vulnerable to attacks and putting both users and brands at risk.
Feature | DNSSEC-Enabled Domains | Non-DNSSEC Domains |
---|---|---|
Seguridad | Cryptographically secured | Vulnerable to DNS attacks |
Trust | Verified, authentic DNS data | Unverified, prone to spoofing |
User Safety | Guaranteed traffic integrity | Risk of traffic interception |
Brand Protection | Shielded from DNS hijacking | Open to reputation damage |
La validación de DNSSEC es un proceso simple que incluye los siguientes pasos:
DNSSEC can benefit anyone with an online presence, from large companies to individual website owners. It helps protect against cyber threats like DNS spoofing and cache poisoning, making it essential for businesses that rely on secure communication, such as e-commerce sites, financial institutions, government agencies, and healthcare providers. Even small businesses and personal websites can use DNSSEC to protect their data and reputation. By securing domain information, DNSSEC ensures users can trust the integrity and authenticity of a site, providing safer, more reliable online experiences for everyone.
"Como agencia web, ofrecemos a nuestros clientes alojamiento compartido y queremos garantizarles que incluso si nuestro servidor experimenta algún problema, sus servicios separados se mantendrán en funcionamiento. Es por eso que recurrí a ClouDNS ...
Grigor Yosifov
CEO @ Forci Web Consulting Ltd