What is DNSSEC?

DNSSEC (DNS Security Extensions) is a set of protocol extensions to the Domain Name System that authenticate DNS responses using public-key cryptography. Standard DNS was designed without built-in security; a resolver trusts whatever answer a nameserver returns. DNSSEC changes that by having the authoritative zone operator sign each resource record set (RRset) with a private key. The corresponding public key is published in the zone as a DNSKEY record. A validating resolver fetches both the requested records and their signatures (RRSIG records), then verifies the signatures against the DNSKEY. The verification chain continues upward through parent zones via DS (Delegation Signer) records, ultimately reaching a trusted root anchor.

DNSSEC does not encrypt DNS data. It provides data origin authentication and integrity. A resolver can be certain that the answer came from the zone owner and was not modified in transit. This stops cache poisoning, man-in-the-middle attacks, and other forms of spoofing. DNSSEC was first specified in RFC 2535 (1999), then redesigned in the DNSSEC-bis documents (RFC 4033, RFC 4034, RFC 4035) in 2005. The root zone was signed in 2010. Today, DNSSEC validation is widely supported by public resolvers such as Google Public DNS, Cloudflare 1.1.1.1, and Quad9, and by many ISP resolvers.

DNSSEC sits on top of the existing DNS protocol. It does not change the query/response transport (UDP/53 or TCP/53), the zone transfer mechanism, or the DNS database structure. It adds new record types: RRSIG (signature), DNSKEY (public key), DS (delegation signer), NSEC/NSEC3 (authenticated denial of existence), and CDNSKEY/CDS (in-band key rollover). Deploying DNSSEC requires a zone operator to generate and manage signing keys, to sign the zone periodically, and to upload DS records to the parent zone. Validators on the resolver side must be configured with a trust anchor (usually the root anchor) to start the chain of trust. DNSSEC adoption is incomplete; many top-level domains and most second-level zones remain unsigned.