A school enabled DNSSEC and told students that a coffee-shop network can no longer see which names their laptops look up. Which statement about that belief is accurate?
Select an answer to reveal the explanation.
Short Explanation
A signature on a letter proves the words were not altered, and it does not hide the envelope from the carrier. You still need DNS over HTTPS or DNS over TLS when the names students look up must stay private. DNSSEC only lets the resolver detect that a record was tampered with.
Full Explanation
DNSSEC attaches cryptographic signatures to DNS records so a validating resolver can tell that a response was altered or that it did not come from a signed zone. The school turned that check on, and it does the integrity job it was built for. The signatures do not encrypt the query a laptop sends, and they do not encrypt the name in the answer that travels back. On the coffee-shop network those packets still show which names the students looked up. DNS over HTTPS or DNS over TLS wraps the conversation between the client and the resolver so the network in the middle cannot read the names. Calling DNSSEC the same thing as DNS over TLS is the trap, because both are DNS security features and only the transport encryption hides the name. A validating resolver on the laptop still has to send the query to learn the record. Validation checks the answer. It does not keep the query on the machine. Exam caveat: encryption hides the name from the coffee shop and still reveals it to the resolver the client chose. Operational check: capture a student lookup on the coffee-shop LAN and confirm the queried name is readable in ordinary DNS, then repeat the capture with DNS over HTTPS or DNS over TLS and confirm that name is no longer visible on that network.