DNSSEC (DNS Security Extensions) adds digital signatures to DNS data. A validating resolver can confirm that an answer really came from the zone owner and was not altered in transit, protecting against cache poisoning and spoofed responses. It authenticates data; it does not encrypt queries.
Why it matters
Plain DNS trusts whatever answer arrives first. With DNSSEC, the zone signs its records (RRSIG) using keys published as DNSKEY, and the parent zone holds a hash of the key as a DS record, creating a chain of trust from the root. The cost is operational risk: if signatures expire or the DS record does not match, validating resolvers return SERVFAIL and your whole domain disappears for those users.
Example
$ dig example.com A +dnssec
;; flags: qr rd ra ad;
example.com. 300 IN A 203.0.113.10
example.com. 300 IN RRSIG A 13 2 300 ...The ad flag (authenticated data) means the resolver validated the answer. Algorithm 13 is ECDSA P-256.
Common mistakes
- Moving DNS providers while leaving the old DS record at the registrar.
- Turning DNSSEC on at the DNS host but never adding the DS record at the registrar, so the chain is incomplete.
- Letting signatures or keys expire with self-managed signing.
- Believing DNSSEC hides queries or replaces HTTPS.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.