DNSSEC

The DNSSEC component adds full DNSSEC validation to DNS resolution. It is a standalone package (php-standard-library/dnssec) that requires a Psl\DNS\ResolverInterface instance from the psl/dns package.

DNSSEC validation verifies that DNS responses have not been tampered with by checking cryptographic signatures (RRSIG), walking trust chains from the DNS root (DS/DNSKEY), and validating authenticated denial of existence proofs (NSEC/NSEC3).

Getting Started

To use DNSSEC, you need two things: a DNS resolver that requests DNSSEC records (dnssec: true), and the DNSSEC validation layer that wraps it.

@example('protocols/dnssec-basic.php')

RRSIG: Signature Verification

Every DNSSEC-signed response includes RRSIG records alongside the answer records. Each RRSIG contains a cryptographic signature over a set of records, the signer's identity, and the key tag to locate the corresponding DNSKEY.

When SecureResolver receives a response, it verifies that the RRSIG signatures are valid using the zone's public keys (DNSKEY records). If any signature is invalid or expired, SignatureFailedException is thrown.

DS/DNSKEY: Trust Chain

DNSSEC trust is established through a chain from the DNS root to the target zone. Each parent zone contains a DS (Delegation Signer) record that is a cryptographic hash of the child zone's DNSKEY. By verifying each link in the chain, TrustChainResolver proves that the zone's keys are authorized by the parent, all the way up to the root trust anchor.

The walk for example.com goes: root (.) DNSKEY > com. DS > com. DNSKEY > example.com. DS > example.com. DNSKEY.

NSEC/NSEC3: Authenticated Denial

When a domain does not exist (NXDOMAIN), the server must prove it. NSEC records list the names that DO exist in sorted order, proving there is no name between them. NSEC3 records do the same but with hashed names to prevent zone enumeration.

SecureResolver validates these proofs automatically. If the proof is missing or invalid, InvalidProofException is thrown.

Trust Anchors

TrustChainResolver uses the IANA root KSK as its trust anchor by default. For fully offline environments, StaticTrustChainResolver accepts pre-loaded DNSKEY records per zone, bypassing all network queries for trust chain resolution.

@example('protocols/dnssec-trust-anchor.php')

Validation Errors

DNSSEC validation produces specific exceptions for each failure mode:

All exceptions extend Psl\DNSSEC\Exception\RuntimeException.

Caching

DNSSEC validation is expensive - each query triggers a trust chain walk from the root zone through every intermediate zone to the target. CachedTrustChainResolver caches the validated trust chain results so subsequent queries to the same TLD reuse the cached chain. Combine with CachedResolver on top to cache the final validated responses.

@example('protocols/dnssec-caching.php')

Kitchen Sink

Compose DNSSEC validation with static entries, hosts file, search domains, split-horizon routing, multiple racing DNS-over-TLS nameservers, and caching. DNSSEC validation only wraps the public DNS path; trusted sources (static, internal, hosts file) are outside the validation boundary.

@example('protocols/dnssec-kitchen-sink.php')

Supported Algorithms

RFC Compliance

See src/Psl/DNSSEC/ for the full API.