DNS authenticity
DNSSEC adds digital signatures to DNS data so validating resolvers can detect forged or altered answers. It authenticates the origin and integrity of DNS responses; it does not encrypt DNS traffic or replace HTTPS.
Signed answersDetect unauthorised changes.
Chain of trustRegistry DS links the keys.
Coordinate changesBad keys can break DNS.
Protection
The authoritative zone signs its record sets. A validating resolver checks those signatures and the chain of trust before accepting an answer, reducing the risk of certain cache-poisoning and response-manipulation attacks.
What it does not do
Queries and answers may still be visible. Use HTTPS to encrypt browser traffic, strong account security to protect changes and appropriate email controls for mail; DNSSEC complements these measures rather than replacing them.
Safe operation
The zone publishes DNSKEY records and the registry stores the matching DS information. If the signer changes without updating the chain, validating users can receive SERVFAIL and lose access. Enable it only where both providers support a managed rollover process.
Article feedback
