DNSSEC

DNSSEC (DNS Security Extensions) adds origin authentication and integrity to DNS. Each authoritative zone signs its records with a private key, and validating recursive resolvers check the signatures before returning the answer. DNSSEC does not encrypt the query or the response — the data stays in clear text — it only proves that the answer came from the real zone and was not altered on the way.

The core record types are DNSKEY (the zone's public keys), RRSIG (signatures over each RRset), DS (a digest of the child zone's key, published in the parent), and NSEC or NSEC3 (authenticated denial of existence, used to prove that a name does not exist). Validation walks a chain of trust: the resolver trusts the root key, the root's DS for the TLD vouches for the TLD's key, the TLD's DS vouches for the zone's key, and the zone's key signs the actual records.

Most zones use a two-key setup: a Key Signing Key (KSK) that only signs the DNSKEY set and is referenced by the parent's DS, and a Zone Signing Key (ZSK) that signs everything else and rotates more often. Rotation has to be coordinated with the TTL of cached signatures and with the parent's DS update so that resolvers always have a valid chain.

When validation fails — broken signature, missing DS after a key change, expired RRSIG — a validating resolver returns SERVFAIL rather than the unsigned answer. That is the security guarantee, but it also means DNSSEC misconfigurations make a domain unreachable for users behind validating resolvers. DNSSEC complements transport security like TLS; it does not replace it.