The war in Ukraine has changed how we think about trust in domain name system (DNS) infrastructure.
At ICANN’s invitation, Ihor Malchenyuk, Strategic Advisor at Cossack Labs, shared lessons from Ukraine at the ICANN Technical Webinar “Securing the DNS: Real-World Lessons”. His central point: DNSSEC and RPKI can prove that a record or route is authentic, but not that the party holding it can be trusted. In wartime, that gap becomes a security problem.
These lessons come from defending large distributed systems under sustained attack, not from research. Cossack Labs builds and protects national-scale systems in Ukraine, from the power grid to defence platforms used by millions. These systems depend on DNS resolution and on public networks that cannot yet be fully trusted, so we have had to harden them ourselves.
Ihor looked at DNS in three roles: a target for attackers, a tool for hiding attacker infrastructure, and a defensive control in its own right. Most of the attacks he described relied on basic techniques used at scale, not on breaking the protocols.
For distributed systems, this means the network beneath them cannot be assumed trustworthy. Our defences rely on overlay VPNs, trusting nothing by default, and verifying anything that matters three times. Each of these is a workaround for a gap in public infrastructure that we have had to close ourselves.
What should be taken into consideration:
- Design trust mechanisms for adversaries, not only for well-behaved operators.
- Define how resources in occupied territory, or leased to sanctioned actors, are handled, so that RPKI-valid does not mean trusted.
- Reconcile DNSSEC with accountable, resolver-level filtering, so states can protect users without impersonating destinations.
Ukraine’s experience shows why DNS security must account not only for technical integrity, but also for the realities of conflict, compromised trust and hostile control of infrastructure. Our goal is that the community’s work makes these workarounds unnecessary.
