The race to secure record-like information for domains
Signed MX adoption is 12.3% in the Tranco top 1,000 and 1.4% of .COM, so apps cannot assume DNSSEC.
Stories per day · 30 days
2 RSS
Relateddns5denial-of-service2ubuntu2bind1email-security1fact-check1gtld1iana1icann1key-rollover1ksk1mx-records1protocol1quantum1rir1root-zone1tls1trust-anchor1
16 stories, newest first · one card per story
Stories tagged #dnssec
Bind vulnerabilities allow denial of service in Ubuntu 26.10
Bind mishandling of DNS messages and DNSSEC proofs could cause excessive memory use or crashes in Ubuntu 26.10.
ICANN speeds quantum-safe DNSSEC work as larger keys strain DNS
Crain now puts readiness at three to five years, not ten, while Category 1 domains show 45 percent higher abuse odds.
Ubuntu fixes Unbound denial-of-service flaws in USN-8946-1
Crafted TCP connections or DNS responses can exhaust resources or crash Unbound; fixed package versions are not in the excerpt.
Root DNSSEC trust anchors
IANA's root DNSSEC KSK-2024, key tag 38696, began signing the root DNSKEY set on October 11, 2026.
The October 2026 Root KSK Rollover: Is Your DNS Really Ready?
Akamai publishes readiness guidance for the October 2026 DNS root KSK rollover, urging operators to verify resolver trust anchor handling.
The keys to the Internet change on October 11. Are you ready?
On October 11, 2026, the DNS root KSK changes; resolvers must already trust KSK-2024 or lookups can fail.
7
BIND DNS Servers Hit by 14 Security Flaws Enabling Cache Poisoning and Remote Crashes
ISC patched 14 high-severity BIND 9 flaws enabling DNS cache poisoning, DNSSEC bypass, and remote crashes of exposed recursive resolvers.
2
Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
NLnet Labs patched a critical heap overflow (CVE-2026-81642) in Unbound's DNSSEC validator that a malicious DNS zone can trigger for possible RCE.
BIND 9.20.29 Fixes 14 Security Flaws Enabling DNSSEC Bypass and Denial-of-Service Attacks
ISC released BIND 9.20.29 patching 14 flaws, including two DNSSEC validation bypasses enabling cache poisoning and multiple denial-of-service bugs.
7
BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS
ISC released BIND 9.20.29 and 9.21.26 fixing 14 flaws, including an unauthenticated DoH crash (CVE-2026-77692) and DNSSEC cache poisoning issues; no exploitation reported.
6
Unbound: 1.26.1 addresses multiple CVE items
Unbound 1.26.1 fixes critical heap buffer overflow CVE-2026-81642 in DNSKEY digesting that may allow remote code execution.
1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
Cloudflare's 1.1.1.1 resolver now validates post-quantum DNSSEC signatures using ML-DSA-44, a 2,420-byte NIST algorithm, preparing DNS for post-quantum migration by 2029.
4
Six new dnsmasq vulnerabilities open the door to DNS cache poisoning, local root
Six dnsmasq flaws enable DNS cache poisoning, DoS, memory leaks, and local root code execution; fixes ship in version 2.92rel2.
2
Hacking Public Wi-Fi DNS to Steal Credentials
Attackers can hijack public Wi-Fi DNS to redirect users to credential-stealing fake login pages; commenters debate HTTPS limits and mitigations like encrypted DNS.
2
ZDI-26-584: dnsmasq DNSSEC NSEC/NSEC3 Type Bitmap Processing Infinite Loop Denial-of-Service Vulnerability
ZDI disclosed an unauthenticated infinite-loop denial-of-service flaw (CVE-2026-4890) in dnsmasq DNSSEC NSEC/NSEC3 bitmap processing.