Deploying DNS Security (DNSSEC) in Large-Scale Operational Environments

Abstract

The Domain Name System (DNS) is used by virtually every Internet application, but has virtually no security. The DNS Security Extensions (DNSSEC) add essential authentication, but deploying DNSSEC in a large-scale environment is non-trivial. This paper examines the operational and technological considerations when DNS operators manage a largescale deployment, such as an ISP with tens of thousands of zones, or a top-level domain that manages millions of domain name resource records.