{"id":14215,"date":"2021-06-03T15:15:53","date_gmt":"2021-06-03T08:15:53","guid":{"rendered":"https:\/\/blog.tinohost.com\/?p=14215"},"modified":"2026-10-28T11:40:08","modified_gmt":"2026-10-28T04:40:08","slug":"dnssec-la-gi","status":"publish","type":"post","link":"https:\/\/tino.vn\/blog\/dnssec-la-gi\/","title":{"rendered":"DNSSEC l\u00e0 g\u00ec? Chu\u1ed7i tin c\u1eady, c\u00e1ch b\u1eadt v\u00e0 ki\u1ec3m tra DNSSEC"},"content":{"rendered":"\n

DNSSEC (Domain Name System Security Extensions) l\u00e0 b\u1ed9 m\u1edf r\u1ed9ng b\u1ea3o m\u1eadt cho DNS, th\u00eam ch\u1eef k\u00fd s\u1ed1 v\u00e0o b\u1ea3n ghi \u0111\u1ec3 resolver ki\u1ec3m tra \u0111\u01b0\u1ee3c c\u00e2u tr\u1ea3 l\u1eddi \u0111\u00fang l\u00e0 c\u1ee7a ch\u1ee7 t\u00ean mi\u1ec1n v\u00e0 kh\u00f4ng b\u1ecb s\u1eeda tr\u00ean \u0111\u01b0\u1eddng \u0111i.<\/strong> DNSSEC kh\u00f4ng m\u00e3 ho\u00e1 truy v\u1ea5n; n\u00f3 ch\u1ed1ng gi\u1ea3 m\u1ea1o, kh\u00f4ng ch\u1ed1ng nghe l\u00e9n.<\/p>\n\n\n\n

DNSSEC b\u1ed5 sung cho DNS<\/a>, h\u1ec7 th\u1ed1ng v\u1ed1n ra \u0111\u1eddi khi ch\u01b0a t\u00ednh t\u1edbi vi\u1ec7c x\u00e1c th\u1ef1c. Ch\u1ee7 t\u00ean mi\u1ec1n<\/a> b\u1eadt DNSSEC \u1edf n\u01a1i ch\u1ea1y nameserver v\u00e0 g\u1eedi m\u1ed9t b\u1ea3n ghi l\u00ean t\u1ea7ng tr\u00ean qua nh\u00e0 \u0111\u0103ng k\u00fd. Ph\u1ea7n d\u01b0\u1edbi gi\u1ea3i th\u00edch DNSSEC ch\u1ed1ng \u0111\u01b0\u1ee3c g\u00ec, c\u00e1c b\u1ea3n ghi m\u1edbi, chu\u1ed7i tin c\u1eady, c\u00e1ch b\u1eadt v\u00e0 ki\u1ec3m tra.<\/p>\n\n\n\n

DNSSEC l\u00e0 g\u00ec?<\/h2>\n\n\n\n

DNSSEC l\u00e0 t\u1eadp ti\u00eau chu\u1ea9n c\u1ee7a IETF, m\u00f4 t\u1ea3 trong RFC 4033<\/a>, RFC 4034 v\u00e0 RFC 4035, cho ph\u00e9p k\u00fd s\u1ed1 d\u1eef li\u1ec7u DNS. Theo ICANN, DNSSEC \u0111em l\u1ea1i hai b\u1ea3o v\u1ec7: x\u00e1c th\u1ef1c ngu\u1ed3n g\u1ed1c d\u1eef li\u1ec7u (data origin authentication) v\u00e0 b\u1ea3o v\u1ec7 t\u00ednh to\u00e0n v\u1eb9n c\u1ee7a d\u1eef li\u1ec7u.<\/p>\n\n\n\n

Ch\u1ee7 zone k\u00fd d\u1eef li\u1ec7u c\u1ee7a m\u00ecnh b\u1eb1ng kho\u00e1 ri\u00eang (private key), c\u00f2n kho\u00e1 c\u00f4ng khai (public key) \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1 ngay trong zone. Resolver c\u00f3 b\u1eadt ki\u1ec3m DNSSEC d\u00f9ng kho\u00e1 c\u00f4ng khai \u0111\u1ec3 ki\u1ec3m ch\u1eef k\u00fd; ch\u1eef k\u00fd sai th\u00ec c\u00e2u tr\u1ea3 l\u1eddi b\u1ecb lo\u1ea1i, ng\u01b0\u1eddi d\u00f9ng nh\u1eadn l\u1ed7i thay v\u00ec b\u1ecb d\u1eabn t\u1edbi m\u00e1y ch\u1ee7 gi\u1ea3.<\/p>\n\n\n\n

DNSSEC ch\u1ed1ng l\u1ea1i nh\u1eefng t\u1ea5n c\u00f4ng n\u00e0o?<\/h2>\n\n\n\n

DNSSEC ch\u1ed1ng c\u00e1c ki\u1ec3u t\u1ea5n c\u00f4ng l\u00e0m resolver tin v\u00e0o c\u00e2u tr\u1ea3 l\u1eddi gi\u1ea3, nh\u01b0 \u0111\u1ea7u \u0111\u1ed9c cache (cache poisoning) v\u00e0 gi\u1ea3 m\u1ea1o ph\u1ea3n h\u1ed3i DNS (DNS spoofing). K\u1ebb t\u1ea5n c\u00f4ng kh\u00f4ng c\u00f3 kho\u00e1 ri\u00eang c\u1ee7a ch\u1ee7 zone n\u00ean kh\u00f4ng t\u1ea1o \u0111\u01b0\u1ee3c ch\u1eef k\u00fd h\u1ee3p l\u1ec7 cho b\u1ea3n ghi gi\u1ea3.<\/p>\n\n\n\n

DNSSEC l\u00e0m \u0111\u01b0\u1ee3c<\/th>DNSSEC kh\u00f4ng l\u00e0m<\/th><\/tr><\/thead>
Ph\u00e1t hi\u1ec7n b\u1ea3n ghi b\u1ecb s\u1eeda ho\u1eb7c gi\u1ea3 tr\u00ean \u0111\u01b0\u1eddng t\u1eeb nameserver t\u1edbi resolver<\/td>M\u00e3 ho\u00e1 truy v\u1ea5n, gi\u1ea5u t\u00ean mi\u1ec1n b\u1ea1n truy c\u1eadp (vi\u1ec7c c\u1ee7a DoH, DoT)<\/td><\/tr>
Ch\u1ee9ng minh m\u1ed9t t\u00ean th\u1eadt s\u1ef1 kh\u00f4ng t\u1ed3n t\u1ea1i (qua NSEC, NSEC3)<\/td>B\u1ea3o v\u1ec7 khi t\u00e0i kho\u1ea3n qu\u1ea3n l\u00fd t\u00ean mi\u1ec1n b\u1ecb chi\u1ebfm v\u00e0 k\u1ebb x\u1ea5u t\u1ef1 k\u00fd b\u1ea3n ghi<\/td><\/tr>
B\u1ea3o v\u1ec7 ng\u01b0\u1eddi d\u00f9ng c\u1ee7a resolver c\u00f3 b\u1eadt ki\u1ec3m DNSSEC<\/td>B\u1ea3o v\u1ec7 \u0111o\u1ea1n t\u1eeb thi\u1ebft b\u1ecb t\u1edbi resolver n\u1ebfu thi\u1ebft b\u1ecb kh\u00f4ng t\u1ef1 ki\u1ec3m<\/td><\/tr>
L\u00e0m n\u1ec1n cho b\u1ea3n ghi b\u1ea3o m\u1eadt kh\u00e1c nh\u01b0 DANE, TLSA<\/td>Thay th\u1ebf ch\u1ee9ng ch\u1ec9 SSL c\u1ee7a website<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

C\u00e1ch m\u00e3 ho\u00e1 DNS b\u1eb1ng DoH, DoT \u0111\u01b0\u1ee3c gi\u1edbi thi\u1ec7u \u1edf m\u1ee5c b\u1ea3o m\u1eadt c\u1ee7a b\u00e0i DNS l\u00e0 g\u00ec<\/a>; ch\u1ee9ng ch\u1ec9 SSL xem \u1edf ch\u1ee9ng ch\u1ec9 SSL l\u00e0 g\u00ec<\/a>.<\/p>\n\n\n\n

DNSSEC th\u00eam nh\u1eefng b\u1ea3n ghi n\u00e0o?<\/h2>\n\n\n\n

DNSSEC th\u00eam b\u1ed1n lo\u1ea1i b\u1ea3n ghi ch\u00ednh \u0111\u01b0\u1ee3c \u0111\u1ecbnh ngh\u0129a trong RFC 4034<\/a>: RRSIG ch\u1ee9a ch\u1eef k\u00fd, DNSKEY ch\u1ee9a kho\u00e1 c\u00f4ng khai, DS n\u1ed1i zone con v\u1edbi zone cha, NSEC ch\u1ee9ng minh t\u00ean kh\u00f4ng t\u1ed3n t\u1ea1i. RFC 5155<\/a> b\u1ed5 sung NSEC3 \u0111\u1ec3 ch\u1ee9ng minh nh\u01b0 NSEC nh\u01b0ng kh\u00f3 li\u1ec7t k\u00ea to\u00e0n b\u1ed9 t\u00ean trong zone.<\/p>\n\n\n\n

B\u1ea3n ghi<\/th>T\u00ean \u0111\u1ea7y \u0111\u1ee7<\/th>Vai tr\u00f2<\/th><\/tr><\/thead>
RRSIG<\/td>Resource Record Signature<\/td>Ch\u1eef k\u00fd s\u1ed1 c\u1ee7a m\u1ed9t nh\u00f3m b\u1ea3n ghi c\u00f9ng t\u00ean, c\u00f9ng lo\u1ea1i (RRset), c\u00f3 th\u1eddi h\u1ea1n hi\u1ec7u l\u1ef1c<\/td><\/tr>
DNSKEY<\/td>DNS Public Key<\/td>Kho\u00e1 c\u00f4ng khai c\u1ee7a zone, d\u00f9ng \u0111\u1ec3 ki\u1ec3m RRSIG. Th\u01b0\u1eddng c\u00f3 KSK (k\u00fd kho\u00e1) v\u00e0 ZSK (k\u00fd d\u1eef li\u1ec7u)<\/td><\/tr>
DS<\/td>Delegation Signer<\/td>B\u1ea3n b\u0103m c\u1ee7a DNSKEY c\u1ee7a zone con, \u0111\u1eb7t \u1edf zone cha; m\u1eaft x\u00edch n\u1ed1i hai t\u1ea7ng<\/td><\/tr>
NSEC \/ NSEC3<\/td>Next Secure<\/td>Ch\u1ee9ng minh m\u1ed9t t\u00ean ho\u1eb7c m\u1ed9t lo\u1ea1i b\u1ea3n ghi kh\u00f4ng t\u1ed3n t\u1ea1i, c\u0169ng \u0111\u01b0\u1ee3c k\u00fd<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

DNSSEC ho\u1ea1t \u0111\u1ed9ng nh\u01b0 th\u1ebf n\u00e0o?<\/h2>\n\n\n\n

DNSSEC ho\u1ea1t \u0111\u1ed9ng theo chu\u1ed7i tin c\u1eady: kho\u00e1 c\u1ee7a m\u1ed7i zone \u0111\u01b0\u1ee3c zone cha x\u00e1c nh\u1eadn b\u1eb1ng b\u1ea3n ghi DS, \u0111i ng\u01b0\u1ee3c l\u00ean t\u1edbi root zone. Resolver ch\u1ec9 c\u1ea7n tin kho\u00e1 c\u1ee7a root (trust anchor) l\u00e0 ki\u1ec3m \u0111\u01b0\u1ee3c m\u1ecdi t\u1ea7ng b\u00ean d\u01b0\u1edbi, mi\u1ec5n l\u00e0 t\u1ea7ng n\u00e0o tr\u00ean \u0111\u01b0\u1eddng \u0111i c\u0169ng \u0111\u00e3 k\u00fd.<\/p>\n\n\n\n

\"S\u01a1<\/figure>\n\n\n\n
    \n
  1. Resolver nh\u1eadn c\u00e2u h\u1ecfi, v\u00ed d\u1ee5 b\u1ea3n ghi A c\u1ee7a tenban.vn, v\u00e0 y\u00eau c\u1ea7u k\u00e8m d\u1eef li\u1ec7u DNSSEC.<\/li>\n\n\n
  2. T\u1eeb root, resolver l\u1ea5y DNSKEY c\u1ee7a root (\u0111\u00e3 c\u00f3 s\u1eb5n l\u00e0m trust anchor) v\u00e0 b\u1ea3n ghi DS c\u1ee7a .vn, ki\u1ec3m ch\u1eef k\u00fd.<\/li>\n\n\n
  3. \u1ede zone .vn, resolver l\u1ea5y DNSKEY c\u1ee7a .vn, so v\u1edbi DS v\u1eeba nh\u1eadn; kh\u1edbp th\u00ec tin kho\u00e1 n\u00e0y v\u00e0 l\u1ea5y ti\u1ebfp DS c\u1ee7a tenban.vn.<\/li>\n\n\n
  4. \u1ede nameserver c\u1ee7a tenban.vn, resolver l\u1ea5y DNSKEY, b\u1ea3n ghi A v\u00e0 RRSIG c\u1ee7a b\u1ea3n ghi A, ki\u1ec3m ch\u1eef k\u00fd b\u1eb1ng kho\u00e1 \u0111\u00e3 \u0111\u01b0\u1ee3c x\u00e1c nh\u1eadn.<\/li>\n\n\n
  5. M\u1ecdi ch\u1eef k\u00fd kh\u1edbp th\u00ec resolver tr\u1ea3 k\u1ebft qu\u1ea3 k\u00e8m c\u1edd AD (\u0111\u00e3 x\u00e1c th\u1ef1c); m\u1ed9t m\u1eaft x\u00edch sai th\u00ec tr\u1ea3 l\u1ed7i SERVFAIL.<\/li>\n<\/ol>\n\n\n\n

    \u1ea2nh d\u01b0\u1edbi ch\u1ee5p Verisign DNSSEC Debugger<\/a> ki\u1ec3m t\u00ean mi\u1ec1n cloudflare.com: c\u00f4ng c\u1ee5 \u0111i l\u1ea7n l\u01b0\u1ee3t t\u1eeb root (.), qua com, t\u1edbi cloudflare.com; \u1edf m\u1ed7i t\u1ea7ng \u0111\u1ec1u t\u00ecm th\u1ea5y b\u1ea3n ghi DS \u1edf zone cha v\u00e0 DS kh\u1edbp DNSKEY c\u1ee7a zone con.<\/p>\n\n\n\n

    \"\u1ea2nh
    \u1ea2nh ch\u1ee5p c\u00f4ng c\u1ee5 Verisign DNSSEC Debugger (dnssec-debugger.verisignlabs.com) ng\u00e0y 27\/10\/2026.<\/figcaption><\/figure>\n\n\n\n

    DNSSEC \u0111\u01b0\u1ee3c tri\u1ec3n khai t\u1eeb khi n\u00e0o?<\/h2>\n\n\n\n

    Theo ICANN<\/a>, IETF b\u1eaft \u0111\u1ea7u x\u00e2y d\u1ef1ng DNSSEC t\u1eeb nh\u1eefng n\u0103m 1990 khi th\u1ea5y DNS c\u1ea7n c\u01a1 ch\u1ebf x\u00e1c th\u1ef1c m\u1ea1nh h\u01a1n. Root zone \u0111\u01b0\u1ee3c k\u00fd DNSSEC n\u0103m 2010, t\u1ea1o \u0111i\u1ec3m kh\u1edfi \u0111\u1ea7u chung cho chu\u1ed7i tin c\u1eady; t\u1eeb \u0111\u00f3 c\u00e1c \u0111u\u00f4i t\u00ean mi\u1ec1n v\u00e0 ch\u1ee7 t\u00ean mi\u1ec1n m\u1edbi c\u00f3 th\u1ec3 k\u00fd theo.<\/p>\n\n\n\n