What is DNSSEC? Securing the Domain Name System

The Threat of DNS Spoofing

Traditional DNS operates over unencrypted UDP without cryptographic signatures. This architectural vulnerability allows attackers to conduct DNS Cache Poisoning (Kaminsky attacks), redirecting users to fraudulent servers.

DNSSEC (Domain Name System Security Extensions) resolves this vulnerability by signing DNS records using public-key cryptography.

The DNSSEC Chain of Trust

[Root Zone (.)] ──── Signed with Root KSK / ZSK
       │
       ▼ (DS Record in Root)
[TLD Zone (.com)] ── Signed with TLD KSK / ZSK
       │
       ▼ (DS Record in .com)
[Authoritative Zone (example.com)] ── Signed with Zone KSK / ZSK
       │
       ▼ (RRSIG Records)
[Resolved A Record] ── Cryptographically Authenticated!

Core DNSSEC Record Types

• RRSIG (Resource Record Signature): Digital signature for a specific record set.
• DNSKEY: Public key used by resolvers to verify RRSIG signatures.
• DS (Delegation Signer): Hash of the child zone's DNSKEY stored in the parent registry.
• NSEC / NSEC3: Cryptographic proof of non-existence for unassigned names.

Example: Signed vs. Unsigned, at a Glance (Illustrative)

Signed zone:     DNSKEY present · DS record in parent zone · RRSIG on every answer
Unsigned zone:   no DNSKEY · no DS record · resolver returns records with no signature

A validating resolver checking a signed zone will set the "Authenticated Data" (AD) flag on its response once the RRSIG chains back to a trusted root. If the DS record in the parent zone doesn't match the child zone's actual key, validation fails closed — the resolver returns SERVFAIL rather than an unverified answer, which is the correct (if occasionally disruptive) behavior after a key rollover gone wrong.

Check DNSSEC Status

Use our WHOIS & RDAP Lookup and DNS Lookup to check if your domain zone delegation is signed with DNSSEC.