DNSSEC

DNSSEC (Domain Name System Security Extensions) is a suite of extensions to DNS that attaches cryptographic signatures to zone data. A validating resolver can then prove that the records it received were published by the actual zone owner and were not altered on the way. This defeats cache poisoning and spoofing attacks, where an attacker injects a forged IP address into a resolver's cache — for example to silently redirect online-banking traffic to a phishing server.

How DNSSEC works

DNSSEC builds a chain of trust from the DNS root down to your domain using public-key cryptography:

1. Zone signing — every record set (RRset) is signed, and the signature is published in an RRSIG record, created with the Zone Signing Key (ZSK).
2. Key publication — the zone's public keys live in DNSKEY records; the Key Signing Key (KSK) signs the DNSKEY set itself.
3. Chain of trust — a hash of the KSK is placed in the parent zone as a DS record (submitted via the registrar), and the parent zone is signed too, all the way up to the root, whose key resolvers ship with.
4. Validation — the resolver walks the chain and verifies every signature; an answer that fails validation is discarded and the client receives SERVFAIL. NSEC/NSEC3 records additionally provide authenticated proof that a name does not exist.

DNSSEC in practice

Signing is most valuable where forged records would be costly: banking and payment domains, e-commerce, corporate mail and APIs. DNSSEC also underpins DANE/TLSA, which pins TLS certificates in DNS. Most major registrars and DNS operators now expose DNSSEC as a toggle: the provider signs the zone, and you pass the generated DS record to the registrar for publication in the parent zone.

Operational caveats deserve respect. Keys must be rotated periodically (key rollover), and the classic failure mode is migrating to a new DNS provider while a stale DS record remains at the registrar — validation then fails everywhere and the domain effectively goes dark until the record is fixed. Remember also that DNSSEC authenticates but does not encrypt; combine it with DoT or DoH for query privacy.