The security administrator at a bank is receiving numerous reports that customers are unable to login to the bank website. Upon further investigation, the security administrator discovers that the…

Security awareness training addresses human behavior but has no technical effect on DNS record tampering performed by an external attacker against the DNS server.

Using recursive DNS from root servers improves name resolution accuracy but does not authenticate or protect the integrity of zone records against unauthorized modification.

TSIG uses a shared secret key and HMAC cryptography to sign DNS messages between servers, ensuring only authorized DNS servers can update zone records. This directly prevents DNS cache poisoning and unauthorized zone transfers that would redirect a legitimate domain to a malicious IP. Without a valid TSIG signature, DNS update requests are rejected by the receiving server.

Firewalls and IDS can detect suspicious traffic patterns but cannot validate or enforce the integrity of DNS records stored on an authoritative DNS server.