No. DNSSEC does not protect the integrity of a DNS name if the registrar for that name is malicious (or compromised). The registrar for grumpyavians.com
is the ultimate source of authority for who owns grumpyavians.com
(and, e.g., what is the public key for grumpyavians.com
). Consequently, if the registrar is malicious or compromised, then the registrar can transfer control or otherwise subvert security.
That said, I believe the situation is not quite as bad as you feared (it is not the case that any registrar anywhere can compromise every DNS name in existence). For instance, as far as I know, some random registrar cannot take control of every domain name under .com
.
Here's my understanding of how it works. Today, Verisign administers .com
. That means that Verisign totally controls .com
, and has the DNSSEC signing keys that lets it create arbitrary records for foo.com
names. There's a long list of domain registrars, who can all register domain names under .com
. The way that works is that the registrar interacts with Verisign to request that some name (say, grumpyavians.com
) be assigned to it; Verisign confirms that no one already owns grumpyavians.com
, then assigns it to the registrar and keeps a record of this assignment. Transferring domains between registrars happens similarly.
Let's say you own some valuable domain name under .com
(say, hungryfelines.com
). Who are your DNSSEC records vulnerable to? They are vulnerable to Verisign, and to your registrar. I don't believe you are vulnerable to any other registrar, assuming that the domain transfer process is adequately secured. Caveat: the domain transfer process is beyond the scope of DNSSEC, but it is a significant potential point of vulnerability in practice.