PlayInfoBox

Home /Network /What Is DNSSEC? How the Chain of Trust Verifies DNS Responses

What Is DNSSEC? How the Chain of Trust Verifies DNS Responses

DNSSEC attaches a digital signature to DNS responses so they can be verified as authentic -- here is how that verification chain actually works.

The problem ordinary DNS never solved

A standard DNS response carries no digital signature. That means an attacker positioned in the middle of the connection can inject a forged response through cache poisoning or spoofing, and the requesting device has no built-in way to tell it apart from the real answer.

What DNSSEC actually does

DNSSEC (Domain Name System Security Extensions) attaches a digital signature to each DNS response, letting the resolver verify it genuinely came from the actual domain owner and was not altered in transit. The key point: this is integrity and authenticity verification, not encryption -- it does not hide what was queried.

The core records: DNSKEY, RRSIG, and DS

DNSKEY holds a zone's public key, RRSIG holds the digital signature covering a specific set of records, and DS (Delegation Signer) is registered in the parent zone to vouch that the child zone's key is legitimate.

Proving a record does not exist, with a signature

Even a "this record does not exist" response can be forged, so NSEC and NSEC3 records provide a signed proof of nonexistence. This prevents an attacker from simply inventing a fake subdomain response.

The chain of trust: from the root down to a domain

The root zone signs the keys of top-level domains, and each top-level domain in turn signs the keys of the individual domains beneath it. Verifying this unbroken chain of signatures all the way to the root confirms that no step along the way was tampered with.

What DNSSEC does not protect against

Because DNSSEC does not encrypt the query itself, anyone who wants to hide what domains are being looked up needs DNS over HTTPS (DoH) or DNS over TLS (DoT) as well. And since DNSSEC signing is opt-in, unsigned domains -- and there are still plenty -- get none of this protection.

How to check whether a domain uses it

On Linux or Mac, adding the +dnssec flag to a dig command shows whether an RRSIG record is included in the response. A number of free online DNSSEC analysis tools will also visually trace a domain's signature chain and flag where, if anywhere, it breaks.

Integrity, not confidentiality

The single most common misunderstanding about DNSSEC is treating it as an encryption technology. It proves a response is authentic and unaltered; it does nothing to hide the fact that a lookup happened or what was looked up. Confidentiality is a separate problem, solved by DoH or DoT.

Adoption is still uneven

Because DNSSEC requires the domain owner and the registry to both set it up correctly, a meaningful share of domains on the internet remain unsigned. A domain being unsigned is not itself a red flag, but it does mean that domain gets no protection against cache poisoning or spoofing from this particular mechanism.

Frequently Asked Questions

Does DNSSEC also encrypt what I am looking up?

No. DNSSEC verifies that a DNS response is authentic and has not been tampered with -- it is not an encryption technology and does not hide the content of a lookup. For that, you would need DoH or DoT.

Is every domain protected by DNSSEC?

No. DNSSEC has to be explicitly configured by the domain owner and registrar, so it is an opt-in feature rather than something applied universally, and plenty of domains still are not signed.