ANS-C01 Question 300
Single answerYour organization is hosting a public-facing web application on Amazon Route 53 and has implemented DNSSEC to enhance DNS security. After enabling DNSSEC for your hosted zone, you notice that some clients are unable to resolve your domain. What is the MOST likely cause of this issue?
- A
The DNSSEC key-signing key (KSK) and zone-signing key (ZSK) were not created correctly.
- B
The parent zone does not have the Delegation Signer (DS) record for your hosted zone.
- C
Amazon Route 53 does not support DNSSEC for public hosted zones.
- D
The client's DNS resolver does not support DNSSEC validation.
Show answer and explanation
Correct answer: B
Explanation
DNSSEC works by establishing a chain of trust from the root zone to a specific domain via DS and DNSKEY records. When DNSSEC is enabled in Amazon Route 53, you must submit the generated DS record to your domain registrar to ensure the parent zone publishes it. If the DS record is not correctly added to the parent zone, clients attempting to validate DNSSEC signatures will fail to resolve the domain, as the chain of trust is incomplete.
- A. Incorrect.
Incorrect. While issues with the KSK and ZSK can cause DNSSEC validation to fail, this is not the MOST likely cause in this scenario. DNSSEC key management issues would typically result in broken signatures, not resolution failures for only some clients.
- B. Correct.
Correct. If the parent zone (e.g., the TLD) does not publish the DS record for your hosted zone, DNSSEC validation will fail because the chain of trust is incomplete. This is a common misconfiguration after enabling DNSSEC.
- C. Incorrect.
Incorrect. Amazon Route 53 does support DNSSEC for public hosted zones. However, you must manually configure the required DS records in the parent zone.
- D. Incorrect.
Incorrect. While DNSSEC validation requires support from the client's DNS resolver, it is unlikely that only some clients would lack such support. Most modern resolvers support DNSSEC.