What Is DNSSEC?
On this page
DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records so that resolvers can verify an answer is authentic and unaltered. It directly addresses the flaw at the heart of DNS spoofing: classic DNS answers are unauthenticated, so a forged one is trusted. DNSSEC makes forgery detectable by signing the truth.
How does DNSSEC work?#
It builds a chain of trust using digital signatures:
- Each zone signs its records with a private key.
- Resolvers verify those signatures with the zone’s public key.
- Each zone’s key is vouched for by its parent, up to the DNS root, whose key is a trusted anchor.
If any record has been tampered with, its signature fails to verify and the resolver rejects it. The result is that answers can be trusted as genuinely from the authoritative source — closing the door on spoofing and cache poisoning.
What DNSSEC does not do#
| DNSSEC provides | DNSSEC does not provide |
|---|---|
| Authenticity of records | Confidentiality of queries |
| Integrity (tamper detection) | Encryption of the DNS path |
| A chain of trust to the root | Protection if a zone is misconfigured |
Because it does not encrypt, DNSSEC pairs naturally with DNS over HTTPS, which adds the privacy DNSSEC lacks.
DNSSEC is the authenticity layer for DNS. More at the Network Security hub.
Frequently asked questions#
What does DNSSEC do?
DNSSEC (DNS Security Extensions) adds digital signatures to DNS records so a resolver can verify that an answer genuinely came from the authoritative source and was not altered in transit. It establishes a chain of trust from the DNS root down to a domain, letting resolvers reject forged or tampered records.
Does DNSSEC encrypt DNS?
No — this is a common misunderstanding. DNSSEC provides authenticity and integrity, not confidentiality: it proves an answer is genuine but does not hide the query or response from observers. For DNS privacy you need DNS over HTTPS or DNS over TLS. The two solve different problems and can be used together.