How does TSIG authenticate name servers in order to perform secured zone transfers?

Question

Options

• ABoth servers mutually verify their X509 certificates.
• BBoth servers use a secret key that is shared between the servers.
• CBoth servers verify appropriate DANE records for the labels of the NS records used to delegate the
• DBoth servers use DNSSEC to mutually verify that they are authoritative for the transferred zone.

• A
  2% (1)
• B
  90% (44)
• C
  6% (3)
• D
  2% (1)

Explanation

TSIG (Transaction SIGnature) works by having both the primary and secondary name server share a pre-configured symmetric secret key. Each DNS message in the zone transfer is signed using HMAC (typically HMAC-MD5 or HMAC-SHA256) with that shared key, allowing each party to verify the other's identity and message integrity.

Why the distractors are wrong:

• A is wrong because TSIG does not use X.509 certificates or PKI - that describes TLS/mTLS, a completely different authentication mechanism.
• C is wrong because DANE records (DNS-Based Authentication of Named Entities) are used to bind TLS certificates to DNS names, not to authenticate zone transfer peers.
• D is wrong because DNSSEC provides data-origin authentication for DNS responses to resolvers - it signs zone data, but it does not authenticate the server-to-server relationship in a zone transfer.

Memory tip: Think of TSIG as a "shared password between two friends" - both servers know the same secret, so they can prove to each other they are who they claim to be. The acronym helps too: Transaction SIGnature = signing transactions with a shared key, not certificates.

No community discussion yet for this question.