Domain Name System Security Extensions (DNSSEC)
Domain Name System Security Extensions (DNSSEC) is a security extension that facilitates the digital signing of internet communications, helping to ensure the integrity and authenticity of transmitted data.
When deploying DNSSEC, a domain name registry introduces a layer of security that can be built upon. This layer of security is part of the chain of trust in the DNS. There can be multiple layers between the user and a server, and in 2014 auDA enabled DNSSEC in the .au and at the second level, such as com.au and org.au. This was an important step towards securing the layer between the .au and the root (“.”) zone.
DNSSEC Policy and Practice Statement
In 2012, auDA’s DNSSEC Working Group and the Security Stability and Advisory Committee (SSAC) commenced a consultation to complete its DNSSEC Policy & Practice Statement (DPS).
This document provides organisations with information on auDA’s deployment of DNSSEC in the .au zone, including policy and controls around the creation, management and protection of the cryptographic keys used to sign the .au zone. Organisations may use this document to determine the level of security they wish to implement when deploying DNSSEC on their own zones. It also provides guidance on the level of confidence that organisations can place in the chain of trust.
- auDA DNSSEC signed the .au zone on 20 November 2014.
- The .au Delegation Signer (DS) records were also submitted to Internet Assigned Numbers Authority (IANA) on 20 November 2014 and were published in the root zone file on 26 November 2014.
- In December 2014 DS records for the following Second Level Domains.
The following 2LDs have had their DS records added to the .au zone:
- com.au
- net.au
- org.au
- act.au
- nsw.au
- nt.au
- qld.au
- sa.au
- tas.au
- vic.au
- wa.au
- conf.au
- asn.au
- id.au
- edu.au
- gov.au.
The following closed zones are not currently signed:
- csiro.au
- oz.au.