What Is DNSSEC?

DNSSEC adds digital signatures to DNS data so a validating resolver can check that an answer is authentic and has not been altered in transit. It protects the integrity of DNS answers when correctly deployed. It does not encrypt DNS queries, hide browsing activity, or replace HTTPS for a website.

How validation works

A signed zone publishes signatures and DNSKEY data. A chain of trust links the parent zone to the child, commonly through a DS record in the parent. A validating resolver checks that chain before accepting a signed answer. If the signatures or links are wrong, validation can fail even while the underlying A or MX value looks plausible.

This is why a registrar and a DNS provider both matter during setup: the DNS provider signs the zone, and the parent-side DS information must match. A stale DS record after changing providers can make a domain appear unreachable to validating resolvers.

What DNSSEC does not solve

DNSSEC authenticates DNS data; it does not prove that the server named by the answer is safe or that its web content is truthful. It also does not keep a registrar account secure. HTTPS certificates and transport encryption address different problems. DNS over HTTPS can encrypt the connection to a resolver, but that alone does not validate the signed DNS chain.

An unsigned domain is not necessarily compromised. Whether to enable DNSSEC depends on provider support and the ability to maintain keys and delegation correctly.

Practical checks

When enabling it, follow your DNS provider's instructions, publish the matching DS at the registrar, and test validation before retiring an old provider. After any nameserver or key change, check that the DS and DNSKEY still align. Use /whois for visible DNS context, but use a dedicated validating resolver or diagnostic tool to confirm the trust chain. The DNS record guide puts the related record types in context.

Sources

• RFC 4033: DNSSEC introduction and requirements
• RFC 1034: DNS zones and delegation