Ballot SC-085 suggests that Certificate Authorities (CAs) should require DNSSEC validation for both CAA (Certification Authority Authorization) record lookups and Domain Control Validation (DCV) procedures. If a CA only checks an unsigned DNS record, a malicious attacker (like a BGP hijacker) could trick the CA into issuing a certificate for a domain they don’t own. DNSSEC validation ensures the DNS response is authentic — it must come from the domain’s real owner.Â
Â
Current Status: Ballot SC-085 is Under IPR Review Period
- Some CAs (like Let’s Encrypt) optionally perform DNSSEC validation today.
CAB Forum guidelines (which govern public CAs) do not yet require DNSSEC validation for DCV. But there’s growing interest in making it a requirement in the future.
What Is DNSSEC?Â
DNSSEC stands for Domain Name System Security Extensions. DNSSEC enables domain owners to digitally sign the information they publish in the Domain Name System (DNS). This helps protect users by ensuring that any corrupted DNS data—whether caused by error or malicious activity—does not reach them.
Â
DNSSEC Validation by CAs Â
In SSL/TLS Certificate issuance, Certificate Authorities (CAs) must verify that a requester actually controls the domain for which they’re requesting a certificate. This is called Domain Control Validation (DCV). Typically, DCV is performed via email, HTTP file upload, or by checking a DNS TXT record. DNSSEC Validation by CAs involves the idea that when a CA conducts Domain Control Validation (DCV)—particularly using a DNS TXT record—it should also check if the DNS response is secured by DNSSEC and confirm its chain of trust. In other words, rather than simply trusting the DNS response, the CA validates the DNSSEC signatures to ensure the data has not been tampered with.Â
Challenges to Mandatory DNSSEC Validation
For DNSSEC to work, registrants must sign their DNS records with DNSSEC, while network operators must enable DNSSEC validation on their resolvers.
- Not all domains have adopted DNSSEC yet, though adoption is increasing.
- Resolver complexity: CAs would require reliable, trusted resolvers to validate DNSSEC.
- Fallback issues: What should happen if DNSSEC validation fails? Should the CA reject the DCV or attempt it again?
Â
Next Steps
Ballot SC-085 is still under discussion at the CA/Browser Forum’s Server Certificate Working Group. Given the complexity of integrating DNSSEC validation into existing CA workflows, there have been suggestions to introduce a delayed effective date for SC-085. If passed, DNSSEC validation would become a mandatory part of the Baseline Requirements for publicly trusted TLS certificates.
