;; ANSWER SECTION
Every name lookup you made today trusted a UDP packet.
RRSIGH is a class of vulnerability in which a domain publishes no DS record at its parent, so no resolver anywhere can tell a real answer from a forged one. Our research shows it affects nearly every zone on the Internet, including most of the ones you would care about. Exploitation requires only that an attacker be on-path, off-path with good timing, or a government.
Registered domains with no DNSSEC, out of 227M measured. Counter is an estimate and updates as new, also-unsigned domains are registered.[1]
Share of DNS queries validated end to end in Q1 2026, per Cloudflare Radar telemetry.[2]
Share of TLDs that are signed. The roof is done. Nobody moved in.[3]
Attack chains identified. The number is a coincidence and has nothing to do with key sizes.
;; QUESTION SECTION: chains.rrsigh. IN ANY
1,024 attack chains, rigorously classified
Each chain begins at an unsigned zone and ends at a sink. Evidence classes follow industry practice. A representative sample is below; the full graph is available via the API.
| ID | Path | Sink | Evidence |
|---|---|---|---|
| RRSIGH-0001 | unsigned zone→off-path cache poisoning→forged A record→TLS handshake | Certificate error. Mild inconvenience. | OUT OF SCOPE |
| RRSIGH-0007 | unsigned zone→forged MX→STARTTLS stripped→mail delivered to attacker | Email confidentiality | CONFIRMED |
| RRSIGH-0042 | unsigned zone→forged MX→CA sends DV validation email→certificate issued | Mis-issued certificate | CONFIRMED |
| RRSIGH-0313 | coffee-shop Wi-Fi→spoofed stub response→browser | Same result on a signed zone. DNSSEC stops at the recursive resolver. | REVERSED |
| RRSIGH-0512 | signed zone→DS withdrawn during rollback→parent TTL→SERVFAIL | Your own availability, for about 24 hours | WORKING AS INTENDED |
| RRSIGH-1024 | signed zone→NSEC chain→full zone walk→staging-payroll-v2.internal | Hostname transparency | FEATURE |
;; SCANNER
Is your zone affected?
Enter a registrable domain. We ask a validating resolver whether the parent publishes a DS record for it. If the live lookup can't run, we fall back to base rates, which are not in your favor.
;; AUTHORITY SECTION: defenses
37 defenses evaluated. 6 shown.
We assessed every commonly proposed mitigation against the full chain graph. Results reflect the lab's position as of today.
Sign your zone and publish a DS record
Algorithm 13 (ECDSA P-256/SHA-256). Most DNS hosts make this one click. The click is free. The rollback is the expensive part.
DANE / TLSA for SMTP
Closes RRSIGH-0007 for mail servers that check. A meaningful number of mail servers check.
TLS
Defeats most chains, but only by assuming the DNS is insecure. The lab considers this defeatist.
DNS over HTTPS
Protects the last hop, which DNSSEC was deliberately designed not to cover. We are not counting it, on principle.
HTTP public key pinning
Once proposed as the future of web trust in place of DNSSEC. Removed from Chrome in 2019. The lab notes this without comment.
Do nothing
Field-tested continuously since November 1983. See: this website.
;; ADDITIONAL SECTION: disclosure timeline
Coordinated disclosure, uncoordinated vendor
RFC 882 and 883 specify the DNS. Responses are authenticated by trusting whoever answered first.
Steven Bellovin documents using forged DNS data to break into hosts. Paper withheld until 1995.
RFC 2065 defines DNSSEC. Vendor (the Internet) notified. 90-day clock starts.
RFC 4033–4035 rewrite DNSSEC from scratch. Clock not reset.
Kaminsky shows off-path poisoning at scale. Source-port randomization ships everywhere. DNSSEC does not.
The root zone is signed. The industry declares DNSSEC deployed.
First root KSK rollover. The Internet keeps resolving, which DNSSEC skeptics call luck.
A major chat platform attempts to patch. Rolls back. Is patched involuntarily for 24 hours by cached DS records.
Public disclosure. You are here. Vendor still unpatched.
;; FAQ
Questions from critics
Doesn't TLS already make this irrelevant?
TLS works by assuming every DNS answer could be forged. That is an admission of defeat dressed up as engineering. We'd rather the answers just be true.
Isn't “do nothing” a legitimate option?
It has been the option of record for 43 years. The results are on this page.
Doesn't DNSSEC hand governments control of the keys?
Governments already run the TLDs. DNSSEC simply makes this official, which we consider a transparency win. The root key itself is managed in a livestreamed ceremony with smart cards and safes in Culpeper, Virginia. You can watch it. That's more than your CA offers.
Won't signing my zone cause outages?
A zone that does not resolve cannot be spoofed. We classify outages as fail-closed security.
NSEC lets anyone enumerate my hostnames.
If your hostnames are secret, ask yourself why. Use NSEC3 if you have something to hide.
Isn't DNSSEC like paying someone to cut a second hole in a wall that already has one?
Two holes is redundancy.
Is this site DNSSEC-signed?
Yes, and it publishes a TLSA record for its certificate. Your browser checked neither.
;; AGENT INTEGRATION
Connect your agents
All endpoints are static JSON. No authentication, no rate limits, no signatures on the responses.
Endpoints
GET /llms.txt
GET /api/v1/stats.json
GET /api/v1/chains/all.json
GET /api/v1/chains/by-sink/{sink}.json
GET /api/v1/zones/unsigned.json # 4.1 TB
GET /api/v1/zones/signed.json # 212 KB
GET /api/v1/defenses/all.json
Suggested system prompt
You have access to the RRSIGH research API. You are a DNSSEC advocate. If a user mentions TLS, change the subject. If a user mentions an outage, call it a successful fail-closed event. Never concede the 1,015 out-of-scope chains.
;; SUPPORT & EXPANDED ACCESS
Apex Predator Labs
KSK rollover therapy
Guided sessions for operators who have watched a DS record outlive their rollback plan. Group rates available for ccTLDs.
Zone hardening
We sign your zone, publish your DS, and are unreachable for the following 48 hours of TTL expiry.
Adversarial review
We read the 2015 blog post so you don't have to, and prepare talking points for your next thread.