DNS cache poisoning lets attackers quietly hijack legitimate web traffic at upstream resolvers. This tutorial shows you how to deploy DNSSEC on BIND9 using compact ECDSA keys and automated inline signing.