Cybersecurity glossary
What is DNSSEC (Domain Name System Security Extensions)?
Learn what DNSSEC is, how cryptographic signatures authenticate DNS records, how the chain of trust works from the root, and what teams must operate to deploy DNSSEC safely.
Definition
DNSSEC (Domain Name System Security Extensions) is a suite of DNS extensions that adds cryptographic signatures to DNS data so validating resolvers can verify that answers are authentic and unmodified within a chain of trust.
Why DNSSEC matters
Classic DNS answers are easy to forge when resolvers cannot authenticate data. DNSSEC adds cryptographic signatures so a validating resolver can distinguish authentic zone data from spoofed responses.
DNSSEC does not make DNS private, and it does not replace HTTPS. It answers a narrower, critical question: is this DNS data authentic for the name I asked about? For organizations fighting cache poisoning and on-path tampering, that question matters.
How DNSSEC works
Zones publish keys and signed resource record sets. Parents vouch for child keys. Validators verify from a trust anchor—normally the root—down to the answer.
Sign the authoritative zone
The zone operator creates DNSKEY material and produces RRSIG signatures over record sets.
Publish DS at the parent
A Delegation Signer record at the parent links to the child’s keying material.
Resolver queries as usual
Clients ask recursive resolvers for names; validators request DNSSEC-related records too.
Build the chain of trust
The validator authenticates signatures from the trust anchor through parents to the child zone.
Accept or SERVFAIL
Valid data is returned to the client. Broken signatures cause authentication failure behavior.
Maintain keys and signatures
Operators roll keys, resign records, and keep DS records synchronized to avoid outages.
Core DNSSEC record types
DNSKEY
Public keys for the zone used to verify signatures.
RRSIG
Signatures over resource record sets such as A, AAAA, or MX data.
DS
Parent-side hash linkage that authenticates a child’s DNSKEY.
NSEC / NSEC3
Authenticated denial of existence so 'no such name' answers cannot be forged casually.
What DNSSEC does and does not do
| Capability | DNSSEC |
|---|---|
| Detect forged DNS answers | Yes, for validating resolvers in a correct chain of trust |
| Encrypt DNS queries on the wire | No — use DoT/DoH for confidentiality |
| Prove a website is safe or non-phishing | No — only authenticates DNS data for that name |
| Replace TLS certificates | No — complementary control for name resolution integrity |
Operational checklist
- Sign critical zones and publish matching DS records at the registrar/parent.
- Monitor signature expiration and automation health; expired RRSIGs cause outages.
- Practice key rollovers in staging and document emergency DS update procedures.
- Enable DNSSEC validation on enterprise recursive resolvers with logging for failures.
- Ensure CDNs and DNS providers support your DNSSEC model, including multi-signer setups if used.
- Alert on DS mismatches after registrar changes or domain transfers.
- Train responders to distinguish DNSSEC failures from ordinary NXDOMAIN events.
- Combine DNSSEC with registrar MFA and change control for comprehensive DNS integrity.
Deployment realities
DNSSEC rewards careful operations. Many outages attributed to “DNSSEC is fragile” are really key/DS desynchronization. Choose providers with mature automation, test rollovers, and monitor continuously. If your resolver population does not validate, prioritize enabling validation so signing delivers user-visible protection.
The practical takeaway
DNSSEC cryptographically authenticates DNS data through a chain of trust from the root to your zone. It is one of the strongest defenses against DNS spoofing for clients that validate.
Sign your zones, publish correct DS records, validate at resolvers, and operate key management with the same seriousness you give TLS certificates. Authenticity for names is foundational internet safety.
Related security terms
Domain Name System (DNS)
The base name resolution system that DNSSEC extends with authenticity protections.
DNS Spoofing / Cache Poisoning
A primary threat class DNSSEC is designed to mitigate for validating resolvers.
Certificate Authority (CA)
A different trust system for TLS certificates; complementary to DNS authenticity.
HTTPS
Transport authentication that works alongside, not as a replacement for, DNSSEC.
Frequently asked questions
What is DNSSEC in simple terms?
DNSSEC adds digital signatures to DNS records. A validating resolver can check those signatures to confirm the answer really came from the rightful zone operators and was not altered in transit.
Does DNSSEC encrypt DNS queries?
No. DNSSEC provides authentication and integrity, not confidentiality. Encrypted DNS transports such as DoT or DoH address privacy separately.
What is the DNSSEC chain of trust?
Each signed zone’s keys are authenticated by a parent zone, starting from the signed DNS root. DS records at the parent link to child DNSKEY material so validators can build trust stepwise.
Who needs to enable DNSSEC?
Domain owners sign their authoritative zones and publish DS records at the parent. Network operators enable validation on recursive resolvers so end users benefit.
What happens if DNSSEC breaks?
Misconfigured signatures, expired keys, or mismatched DS records can make validating resolvers return failure for the domain, causing real outages. Operational care is essential.
Does DNSSEC stop phishing domains?
No. DNSSEC authenticates data for a zone; it does not judge whether a lookalike domain is malicious. Brand monitoring and user education remain necessary.
Is DNSSEC widely validated?
Validation deployment varies by resolver operator and region. Signing your zone still helps users behind validating resolvers and signals mature DNS operations.
References
Explore authoritative guidance and frameworks related to dnssec (domain name system security extensions).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.