Domain Name System Security Extensions(DNSSEC)는 도메인 이름 조회에 대한 응답을 인증하는 DNS(도메인 이름 시스템) 기능입니다.
DNSSEC는 이러한 조회에 대해 개인정보 보호를 제공하지 않지만 공격자가 DNS 요청에 대한 응답을 조작 또는 악성 처리하는 것을 방지합니다.
스푸핑 및 포이즈닝 공격으로부터 도메인을 보호하기 위해 다음 위치에서 DNSSEC를 사용 설정하고 구성하세요.
DNS 영역. 영역에 DNSSEC를 사용 설정한 경우 Cloud DNS가 DNSSEC 키(DNSKEY 레코드) 생성 및 순환과 리소스 레코드 디지털 서명(RRSIG) 레코드를 사용한 영역 데이터 서명을 자동으로 관리합니다.
최상위 도메인(TLD) 레지스트리(example.com의 경우 .com)입니다. TLD 레지스트리에 해당 영역의 DNSKEY 레코드를 인증하는 DS 레코드가 있어야 합니다. 이를 위해서는 도메인 등록기관에서 DNSSEC를 활성화하면 됩니다.
DNS 리졸버. 완벽한 DNSSEC 보호를 위해서는 DNSSEC 서명 도메인에 대한 서명을 검증하는 DNS 리졸버를 사용해야 합니다. 네트워크의 DNS 서비스의 관리자인 경우 개별 시스템 또는 로컬 캐싱 리졸버에 대해 검증을 사용 설정할 수 있습니다.
두 번째 사항은 DNSSEC가 작동할 수 있는 도메인 이름을 제한합니다.
등록기관 및 레지스트리 모두는 사용 중인 TLD의 DNSSEC를 지원해야 합니다. 도메인 등록기관을 통해 DS 레코드를 추가하여 DNSSEC를 활성화할 수 없으면 Cloud DNS에서 DNSSEC를 사용 설정해도 아무런 효과가 없습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eDNSSEC authenticates domain name lookup responses, preventing attackers from manipulating or poisoning them, but it does not offer privacy for these lookups.\u003c/p\u003e\n"],["\u003cp\u003eTo fully protect domains with DNSSEC, it must be enabled in the DNS zone, the top-level domain (TLD) registry, and the DNS resolver.\u003c/p\u003e\n"],["\u003cp\u003eDNSSEC's functionality is contingent on both the domain registrar and the registry supporting the TLD, otherwise enabling DNSSEC in Cloud DNS will have no effect.\u003c/p\u003e\n"],["\u003cp\u003eCloud DNS supports the migration of DNSSEC-enabled zones to and from other DNS operators without disrupting the chain of trust.\u003c/p\u003e\n"],["\u003cp\u003eBefore enabling DNSSEC, verify that your domain registrar and TLD registry both support DNSSEC and check for registrar-specific instructions.\u003c/p\u003e\n"]]],[],null,["# DNS Security Extensions (DNSSEC) overview\n\nThe Domain Name System Security Extensions (DNSSEC) is a feature of the Domain\nName System (DNS) that authenticates responses to domain name lookups.\nIt does *not* provide privacy protections for those lookups,\nbut prevents attackers from manipulating or poisoning the responses to DNS\nrequests.\n\nTo protect domains from spoofing and poisoning attacks, enable and configure\nDNSSEC in the following places:\n\n1. The DNS zone. If you [enable DNSSEC](/dns/docs/dnssec-config#enabling) for\n a zone, Cloud DNS automatically manages the creation and rotation of\n DNSSEC keys (DNSKEY records) and the signing of zone data with resource\n record digital signature (RRSIG) records.\n\n2. The top-level domain (TLD) registry (for `example.com`, this would be `.com`).\n In your TLD registry, you must have a DS record that authenticates a DNSKEY\n record in your zone. Do this by [activating DNSSEC](/dns/docs/registrars#add-ds)\n at your domain registrar.\n\n3. The DNS resolver. For full DNSSEC protection, you must use a DNS resolver\n that *validates* signatures for DNSSEC-signed domains. You can enable\n validation for individual systems or your local caching resolvers if you\n administer your network's DNS services.\n\n For more information about DNSSEC validation, see the following resources:\n - [Do you have DNSSEC validation enabled?](https://blog.apnic.net/2017/05/11/dnssec-validation-enabled/)\n - [Deploying DNSSEC with BIND and Ubuntu Server\n (Part 1)](https://blog.apnic.net/2019/05/23/how-to-deploying-dnssec-with-bind-and-ubuntu-server/)\n - [DNSSEC Guide: Chapter 3. Validation](https://dnsinstitute.com/documentation/dnssec-guide/ch03s03.html)\n - [DNSSEC](https://wiki.debian.org/DNSSEC)\n\n You can also configure systems to use public resolvers that validate DNSSEC,\n notably [Google Public DNS](https://developers.google.com/speed/public-dns/docs/using)\n and [Verisign Public DNS](https://www.verisign.com/security-services/public-dns/index.xhtml).\n\nThe second point limits the domain names where DNSSEC can work.\nBoth the [registrar and registry](https://support.google.com/domains/answer/3251189)\nmust support DNSSEC for the TLD that you are using. If you cannot add a DS\nrecord through your domain registrar to activate DNSSEC,\nenabling DNSSEC in Cloud DNS has no effect.\n\nBefore enabling DNSSEC, check the following resources:\n\n- The DNSSEC documentation for both your domain registrar and TLD registry\n- The [Google Cloud community tutorial's](/community/tutorials/dnssec-cloud-dns-domains#domain_registrar-specific_instructions) domain registrar-specific instructions\n- The [ICANN list](https://www.icann.org/search/#!/?searchText=domain%20registrar%20DNSSEC%20support) of domain registrar DNSSEC support to confirm DNSSEC support for your domain.\n\nIf the TLD registry supports DNSSEC, but your registrar does not\n(or does not support it for that TLD), you might be able to transfer\nyour domains to a different registrar that does. After you have completed that\nprocess, you can activate DNSSEC for the domain.\n\nManagement operations\n---------------------\n\nFor step-by-step instructions for managing DNSSEC, see the following resources:\n\n- To change the DNSSEC state of the zone from `Transfer` to `On`, see\n [Leaving DNSSEC transfer state](/dns/docs/dnssec-config#leaving-transfer).\n\n- To enable DNSSEC for delegated subdomains, see\n [Delegating DNSSEC-signed subdomains](/dns/docs/dnssec-advanced#subdelegation).\n\nRecord set types enhanced by DNSSEC\n-----------------------------------\n\nFor more information about record set types and other record types, see the\nfollowing resources:\n\n- To control which public certificate authorities (CAs) can generate TLS or\n other certificates for your domain, see\n [CAA records](/dns/docs/dnssec-advanced#caa).\n\n- To enable opportunistic encryption through IPsec tunnels, see\n [IPSECKEY records](/dns/docs/dnssec-advanced#ipseckey).\n\nDNS record types with DNSSEC-secured zones\n------------------------------------------\n\nFor more information about DNS record types and other record types, see the\nfollowing resource:\n\n- To enable SSH client applications to validate SSH servers, see [SSHFP records](/dns/docs/dnssec-advanced#sshfp).\n\nMigration or transfer of DNSSEC-enabled zones\n---------------------------------------------\n\nCloud DNS supports migrating DNSSEC-enabled zones where DNSSEC has been\nactivated at the domain registry without breaking the chain of trust. You can\nmigrate zones to or from other DNS operators that also support migration.\n\n- To migrate a DNSSEC-signed zone to Cloud DNS, see\n [Migrate DNSSEC-signed zones to Cloud DNS](/dns/docs/dnssec-migrate#migrating-to).\n\n- To migrate a DNSSEC-signed zone to another DNS operator, see\n [Migrate DNSSEC-signed zones from Cloud DNS](/dns/docs/dnssec-migrate#migrating-from).\n\nIf your existing domain is hosted by your registrar, we recommend migrating the\nname servers to Cloud DNS before transferring to another registrar.\n\nWhat's next\n-----------\n\n- To view DNSSEC key records, see [View DNSSEC keys](/dns/docs/dnskeys).\n- To work with managed zones, see [Create, modify, and delete zones](/dns/docs/zones).\n- To find solutions for common issues that you might encounter when using Cloud DNS, see [Troubleshooting](/dns/docs/troubleshooting).\n- To get an overview of Cloud DNS, see [Cloud DNS overview](/dns/docs/overview)."]]
