The security administrator at a bank is receiving numerous reports that customers are unable to login to the bank website. Upon further investigation, the security administrator discovers that the…

Security awareness training educates users but does not technically prevent or mitigate DNS record tampering at the infrastructure level.

Recursive DNS from root servers changes how queries are resolved but does not authenticate zone updates or prevent an attacker from modifying DNS records on the authoritative server.

TSIG uses HMAC-based message authentication codes with a shared secret to cryptographically sign DNS messages, ensuring that only authorized parties can update zone records. When an attacker modifies DNS records to point a domain name to an unauthorized IP address - a DNS hijacking or cache poisoning attack - TSIG prevents the fraudulent update from being accepted by the authoritative DNS server. Deploying TSIG means unauthorized DNS changes are rejected before they can redirect customer traffic.

Firewalls and IDS technologies can detect anomalous traffic but do not authenticate DNS update transactions or prevent unauthorized changes to DNS zone data.