What Is DNSSEC?

At a glance

DNSSEC adds verifiable signatures to DNS records, allowing a resolver to check that data comes from the correct zone and has not been changed in transit. It authenticates DNS data rather than encrypting webpage content.

Which DNS risks does DNSSEC address?

Ordinary DNS returns domain records without providing an end-to-end proof of their authenticity. If a recursive resolver receives a forged answer and caches it, later users may be sent to the wrong address. DNSSEC adds digital signatures so a validating resolver can check that an answer comes from the corresponding authoritative zone and has not changed along the way.

DNSSEC protects authenticity and integrity. It neither hides DNS queries nor encrypts communication between the browser and website. HTTPS normally protects webpage traffic. Encrypting DNS transport to reduce observation is the role of protocols such as DoH and DoT.

How the chain of trust reaches a domain

• The root zone provides the trusted starting point. Parent zones publish DS records containing digests of child-zone keys, linking successive delegations.
• A zone publishes verification keys in DNSKEY records and signs record sets such as A, MX and TXT with RRSIG records. The resolver checks that signatures, keys and the parent DS records form a consistent chain.
• When a queried name does not exist, NSEC or NSEC3 records provide signed denial of existence, preventing an attacker from freely fabricating NXDOMAIN answers.
• A broken delegation, mismatched key, expired signature or incompatible algorithm can cause a validating resolver to return SERVFAIL instead of delivering unverifiable data.

Why key rotation and configuration mistakes matter

Deploying DNSSEC is more than adding a DS record once. Operators must manage zone-signing and key-signing keys, refresh signatures, update algorithms and coordinate old and new keys during DNS-provider changes. If the parent DS still points to an old key after the child zone removes it, the domain may become unavailable to validating resolvers.

A useful troubleshooting sequence is to check ordinary resolution, then verify the relationship between DS, DNSKEY and RRSIG, signature expiry, server clocks and consistency across authoritative servers. Staged key rotation with an overlap period is generally safer than deleting the old key immediately.

Practical use and interpretation

Valid DS and DNSKEY records with a verifiable signature chain establish that the domain has a DNSSEC validation path. DNSKEY records without a parent DS may mean the zone is prepared for signing but not yet linked to the parent's chain of trust.

When DNSSEC records cannot be obtained, distinguish a confirmed absence from an incomplete lookup. Working DNSSEC suggests attention to DNS integrity, but does not establish the safety of website content, server software or HTTPS configuration. Those are separate security layers.

Points to consider

DNSSEC can reduce cache poisoning and forged DNS answers, but configuration errors can also make a domain fail to resolve.

Frequently asked questions

Does DNSSEC encrypt DNS queries?

No. It signs DNS data so answers can be checked for authenticity and modification. DoH or DoT encrypt query transport between a client and its resolver.

Why might a domain stop working after DNSSEC is enabled?

Common causes include a parent DS that does not match the current DNSKEY, expired signatures, unsupported algorithms or inconsistent authoritative servers. A validating resolver usually rejects an answer when its trust chain is broken.

Is a website without DNSSEC unsafe?

That conclusion does not follow. Its DNS chain lacks this particular authenticity check, but website security also depends on HTTPS, application security, account protection and infrastructure management.