RFC 2065:Domain Name System Security Extensions
RFC-Ref

resource record


Click on the red underlined text to get to the source

... Section 3 discusses the KEY resource record, its structure, use in DNS responses, and file representation. These resource records ...
... resource record, its structure, use in DNS responses, and file representation. These resource records represent the public keys of entities named in the DNS ...
... Section 4 discusses the SIG digital signature resource record, its structure, use in DNS responses, and file representation. These ...
... structure, use in DNS responses, and file representation. These resource records are used to authenticate other resource records in ...
... resource records are used to authenticate other resource records in the DNS and optionally to authenticate ...
... Section 5 discusses the NXT resource record and its use in DNS responses. The NXT RR permits authenticated ...


... Resource records (RRs) are defined to associate keys with DNS names. ...
... The syntax of a KEY resource record (RR) is described in Section 3. It includes an algorithm identifier ...
... DNS servers will automatically attempt to return KEY resources as additional information, along with those resource records actually requested, to minimize the number of queries needed. ...
... Authentication is provided by associating with resource records in the DNS cryptographically generated digital signatures ...
... The SIG Resource Record ...
... The syntax of a SIG resource record (signature) is described in Section 4. It includes the type of the RR ...
... Every name in a secured zone will have associated with it at least one SIG resource record for each resource type under that name except for glue RRs and delgation point NS ...
... resolver must retrieve all the SIG records for a name and select the one or ones that sign the resource record(s) that resolver is interested in. ...
... signature is verified. This conflicts with our desire to have the time-to-live field tick down when resource records are cached. ...
... There are two cases where a SIG resource record is signed by other than the zone private key. One is for support of dynamic update ...
... data origin authentication service described above protects retrieved resource records but provides no protection for DNS requests or for message headers ...
... been diddled in transit. This is accomplished by optionally adding a special SIG resource record at the end of the reply which digitally signs the concatenation of the server's response and the resolver's ...


... The KEY Resource Record ...
... The KEY resource record (RR) is used to document a key that is associated with a Domain Name System ...


... The SIG Resource Record ...
... The SIG or "signature" resource record (RR) is the fundamental way that data is authenticated ...


... The NXT Resource Record ...
... The NXT resource record is used to securely indicate that RRs with an owner name in a certain name interval do not exist in a zone and to ...


... It should be noted that, at most, these extensions guarantee the validity of resource records, including KEY resource records, retrieved from the DNS ...
... validity of resource records, including KEY resource records, retrieved from the DNS. They do not magically solve other security problems ...



Google
Web
RFC-Ref