What is DNSSEC?
Learn what DNSSEC is, what DNSKEY and DS records do, and why DNSSEC matters for DNS integrity.
What DNSSEC is
DNSSEC (Domain Name System Security Extensions) adds cryptographic validation to DNS so resolvers can verify that responses have not been altered.
It protects the integrity and authenticity of DNS data, but it does not encrypt DNS traffic.
Why DNSSEC exists
Traditional DNS does not include built-in mechanisms to verify that responses are genuine.
DNSSEC helps mitigate risks such as spoofed responses and certain cache poisoning attacks by allowing resolvers to validate a chain of trust.
How DNSSEC works in principle
DNSSEC works by signing DNS records with private keys and allowing resolvers to verify those signatures using public keys published in DNS.
Each zone signs its own data, and trust is established through a chain that links child zones to parent zones.
; Example flow
example.com. IN DNSKEY ...
example.com. IN RRSIG ...
; Parent zone
example.com. IN DS ...Important record types
- DNSKEY: publishes the public keys used to verify signatures
- RRSIG: contains the cryptographic signatures for DNS records
- DS: links a child zone to its parent, forming the chain of trust
example.com. 3600 IN DNSKEY 257 3 8 AwEAAc...
example.com. 3600 IN RRSIG A 8 2 3600 ...
example.com. 3600 IN DS 12345 8 2 ABCDEF...The chain of trust
DNSSEC validation relies on a chain of trust starting from the root zone.
Each level (root → TLD → domain) validates the next using DS and DNSKEY records.
Root zone
↓ (DS)
.com
↓ (DS)
example.com
↓ (DNSKEY + RRSIG)
A / MX / other recordsIf any link in this chain is broken, validation will fail.
What to check in practice
A practical starting point is to confirm that DNSKEY records exist in the zone and that matching DS records exist at the parent level.
# Check DNSKEY
dig DNSKEY example.com
# Check DS at parent
dig DS example.com
# Validate with DNSSEC
dig +dnssec example.comThese checks help confirm that DNSSEC is present and that the chain of trust is likely intact.
Why DNSSEC matters
DNSSEC helps ensure that users are directed to the correct destinations by preventing tampering with DNS responses.
It is particularly important for protecting critical infrastructure, authentication flows, and services that rely on DNS trust.
Common DNSSEC issues
- DNSKEY present but DS missing at the parent
- Mismatch between DS and DNSKEY records
- Expired or invalid signatures (RRSIG)
- Incorrect key rollovers
- Enabling DNSSEC without fully understanding the chain of trust