DNSSEC with Route 53: Protecting the core of the Internet

Andreas Wittig – 22 Mar 2021

The Internet relies on DNS. This makes it all the more important to do everything possible to protect the global DNS infrastructure from attacks. Andreas explains how DNSSEC protects from DNS spoofing. During the demo you will learn how to enable DNSSEC for your domains by using Route 53.

DNSSEC with Route 53: Protecting the core of the Internet

What you will learn by watching the video and following the demo?

  • Protect from DNS spoofing!
  • What is DNSSEC?
  • How to enable DNSSEC with Route 53?
  • Pros and Cons of DNSSEC

Enjoy the video!

Why is DNSSEC important? Because, DNSSEC protects from the following attach, called DNS spoofing.

Looking for a new challenge?


    Senior Lead Cloud Solutions Architect AWS

    DEMICON • AWS Advanced Consulting Partner • Remote (Europe)
    GitLab Terraform K8s EKS Lambda Python Go
  • tecRacer

    Cloud Consultant • Machine Learning & Data Analytics

    tecRacer • Premier AWS Consulting Partner • Germany, Austria, Portugal, and Switzerland
    SageMaker Airflow Athena Redshift

  1. Attacker injects DNS records into DNS server/resolver.
  2. User resolves domain name, DNS server responds with “wrong” IP address.
  3. User sends requests to “wrong” server.
  4. Attacker steals password, reads sensitive information, …

DNS Spoofing

The CloudFormation templates used in the video are available at https://github.com/widdix/aws-cf-templates

I’ve used the following commands to deploy DNSSEC to us-east-1. Make sure to modify the stack names and parameters before using the commands.

aws cloudformation deploy --stack-name cloudonautio-key --template-file security/kms-key.yaml --parameter-overrides Service=dnssec-route53 KeySpec=ECC_NIST_P256 KeyUsage=SIGN_VERIFY
aws cloudformation deploy --stack-name cloudonautio-hz --template-file vpc/zone-legacy.yaml --parameter-overrides HostedZoneName=cloudonaut.io HostedZoneId=Z18W2IF733UZVC
aws cloudformation deploy --stack-name cloudonautio-dnssec --template-file vpc/zone-dnssec.yaml --parameter-overrides ParentZoneStack=cloudonautio-hz ParentKmsKeyStack=cloudonautio-key ParentAlertStack=operations-alert

When it comes to DNS, I’m using the book DNS and BIND to learn about the technical details.

A few links discussing DNSSEC:

Become a cloudonaut supporter

Andreas Wittig

Andreas Wittig ( Email Twitter LinkedIn Mastodon )

We launched the cloudonaut blog in 2015. Since then, we have published 366 articles, 60 podcast episodes, and 58 videos. It's all free and means a lot of work in our spare time. We enjoy sharing our AWS knowledge with you.

Please support us

Have you learned something new by reading, listening, or watching our content? With your help, we can spend enough time to keep publishing great content in the future. Learn more

Amount must be a multriply of 5. E.g, 5, 10, 15.

Thanks to Alan Leech, Alex DeBrie, ANTHONY RAITI, Christopher Hipwell, e9e4e5f0faef, Jason Yorty, Jeff Finley, jhoadley, Johannes Grumböck, Johannes Konings, John Culkin, Jonas Mellquist, Jonathan Deamer, Juraj Martinka, Ken Snyder, Markus Ellers, Oriol Rodriguez, Ross Mohan, Ross Mohan, sam onaga, Satyendra Sharma, Simon Devlin, Thorsten Hoeger, Todd Valentine, Victor Grenu, waldensystems, and all anonymous supporters for your help! We also want to thank all supporters who purchased a cloudonaut t-shirt.