Transparent DNSSEC-signing proxy

1. A method in a proxy Domain Name System (DNS) server, comprising:

receiving, from a client device, a DNS query for a domain name as a result of a name server of a second DNS server being changed to point to the proxy DNS server;

transmitting, to the second DNS server, the DNS query for the domain name;

receiving, from the second DNS server, an answer to the DNS query that is unsigned;

signing the received answer to the DNS query, wherein the received answer to the DNS query includes a resource record, and wherein signing the received answer to the DNS query includes generating a resource record digital signature (RRSIG) record that includes a signature of the resource record wherein signing the received answer to the DNS query includes using a private zone signing key (ZSK) managed by the proxy DNS server, and wherein the proxy DNS server creates a DNSKEY record that includes a public ZSK, the DNSKEY record further includes a public key signing key (KSK), and further comprising signing the public ZSK and the public KSK of the DNSKEY record with a private key signing key (KSK), and the proxy DNS server creates a delegate signer (DS) record from the public KSK;

caching, at the proxy DNS server, the signed DNS answer, wherein caching the signed answer includes caching the resource record and caching the RRSIG;

transmitting, to the client device, the signed DNS answer;

receiving, from a second client device, a second DNS query for the domain name;

determining that the signed DNS answer is cached; and

responsive to determining that the signed DNS answer is cached, transmitting, to the second client device, the signed DNS answer as an answer to the second DNS query.

2. An apparatus, comprising:

a proxy Domain Name System (DNS) server including a set of one or more processors and a set of one or more non-transitory machine-readable storage mediums storing instructions, that when executed by the set of processors, cause the set of processors to perform the following operations:

receive, from a client device, a DNS query for a domain name as a result of a name server of a second DNS server being changed to point to the proxy DNS server;

transmit, to a second DNS server, the DNS query for the domain name;

receive, from the second DNS server, an answer to the DNS query that is unsigned;

sign the received answer to the DNS query, wherein the received answer to the DNS query includes a resource record, and wherein to sign the received answer to the DNS query includes to generate a resource record digital signature (RRSIG) record that includes a signature of the resource record, wherein signing the received answer to the DNS query includes using a private zone signing key (ZSK) managed by the proxy DNS server, and wherein the proxy DNS server creates a DNSKEY record that includes a public ZSK, the DNSKEY record further includes a public key signing key (KSK), and further comprising signing the public ZSK and the public KSK of the DNSKEY record with a private key signing key (KSK), and the proxy DNS server creates a delegate signer (DS) record from the public KSK;

cache, at the proxy DNS server, the signed DNS answer, wherein to cache the signed answer includes to cache the resource record and to cache the RRSIG;

transmit, to the client device, the signed DNS answer;

receive, from a second client device, a second DNS query for the domain name;

determine that the signed DNS answer is cached; and

responsive to determining that the signed DNS answer to the DNS query is cached, transmit, to the second client device, the signed DNS answer as an answer to the second DNS query.

3. A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor of a proxy Domain Name System (DNS) server, causes said processor to perform operations comprising:

receiving, from a client device, a DNS query for a domain name as a result of a name server of a second DNS server being changed to point to the proxy DNS server;

transmitting, to a second DNS server, the DNS query for the domain name;

receiving, from the second DNS server, an answer to the DNS query that is unsigned;

signing the received answer to the DNS query, wherein the received answer to the DNS query includes a resource record, and wherein signing the received answer to the DNS query includes generating a resource record digital signature (RRSIG) record that includes a signature of the resource record wherein signing the received answer to the DNS query includes using a private zone signing key (ZSK) managed by the proxy DNS server, and wherein the proxy DNS server creates a DNSKEY record that includes a public ZSK, the DNSKEY record further includes a public key signing key (KSK), and further comprising signing the public ZSK and the public KSK of the DNSKEY record with a private key signing key (KSK), and the proxy DNS server creates a delegate signer (DS) record from the public KSK;

caching, at the proxy DNS server, the signed DNS answer, wherein caching the signed answer includes caching the resource record and caching the RRSIG;

transmitting, to the client device, the signed DNS answer;

receiving, from a second client device, a second DNS query for the domain name;

determining that the signed DNS answer is cached; and

responsive to determining that the signed DNS answer is cached, transmitting, to the second client device, the signed DNS answer as an answer to the second DNS query.