  The absence of security measures between DNS recursive resolvers and
authoritative nameservers has been exploited by both inline and off-path
attacks. While many security proposals have been made in practice and previous
literature, they typically suffer from deployability barriers and/or inadequate
security properties. The absence of a broadly adopted security solution between
resolvers and nameservers motivates a new scheme that mitigates these issues in
previous proposals. We present DNSSEC+, which addresses security and
deployability downsides of DNSSEC, while retaining its benefits. DNSSEC+ takes
advantage of the existent DNSSEC trust model and authorizes the nameservers
within a zone for short intervals to serve the zone data securely, facilitating
real-time security properties for DNS responses, without requiring long-term
private keys to be duplicated (thus put at risk) on authoritative nameservers.
Regarding name resolution latency, DNSSEC+ offers a performance comparable to
less secure schemes. We define nine security, privacy, and deployability
properties for name resolution, and show how DNSSEC+ fulfills these properties.
