DNSSEC (DNS Security Extensions) adds origin authentication and data integrity to DNS responses through digital signatures, without providing encryption or confidentiality.
Each zone owner signs their DNS records with a private key; the public key is published as a DNSKEY record. When a resolver queries a domain, it receives the response along with an RRSIG (resource record signature). The resolver validates this signature against the DNSKEY to confirm the data is authentic and unchanged.
Trust is built as a chain: the parent zone publishes a DS (Delegation Signer) record—a hash of the child zone's DNSKEY—signed by the parent's own key. This chain extends up to the root zone, whose trust anchor (self-signed key) is pre-configured in validating resolvers.
Two key types are typically used: a Zone Signing Key (ZSK) signs individual records, and a Key Signing Key (KSK) signs the DNSKEY RRset and is referenced by the parent's DS record.
DNSSEC also provides authenticated denial of existence through NSEC and NSEC3 records, proving that a queried name does not exist.
Key limitation: DNSSEC guarantees authenticity and integrity only—not availability or confidentiality. Misconfigured signatures (expired RRSIG, mismatched DS/DNSKEY after a key rollover) cause validating resolvers to return SERVFAIL, breaking resolution entirely. This makes key rollover a critical operational task requiring careful coordination between parent and child zones.
Learn more about DNS and how DNS propagation works.
WarningWith DNSSEC enabled, the DS record at your registrar must always match your zone's keys. If they drift — often after moving providers — the entire domain fails to resolve.