DNSSEC (DNS Security Extensions) is a suite of DNS extensions that add cryptographic signatures to DNS records, allowing resolvers to verify that the DNS data they receive is authentic and has not been tampered with.

Does DNSSEC encrypt DNS traffic?

No. DNSSEC authenticates DNS responses but does not encrypt them. The data is still transmitted in plaintext. For encryption, DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) are used instead.

How do I enable DNSSEC?

DNSSEC is enabled at the DNS registrar level. You need to: generate DNSKEY records at your nameserver, create DS records, and submit them to your registrar who publishes them in the parent zone.

What is DNSSEC? DNS Security Extensions Explained

DNSSEC (DNS Security Extensions) is a set of extensions that add cryptographic authentication to DNS responses. Without DNSSEC, an attacker can forge DNS responses and redirect traffic to malicious servers — a technique known as DNS cache poisoning.

Each level signs the key of the level below it, all the way down from the root.

The Problem DNSSEC Solves

Standard DNS was designed without security in mind. When your computer asks "what is the IP address of bank.com?", it trusts whatever response it gets. An attacker positioned between you and the DNS server can inject a fake response, redirecting you to a phishing site.

DNSSEC solves this by having DNS zones sign their records with a private key. Resolvers can verify the signature using the corresponding public key, ensuring the response came from the legitimate zone owner.

How DNSSEC Works

The zone owner generates a key pair (DNSKEY records) and signs all DNS records with the private key, producing RRSIG records
The public key (DNSKEY) is published in DNS
A hash of the public key (DS record) is submitted to the parent zone (.com, .org, etc.)
The parent zone is also signed, all the way up to the root zone
When a resolver receives a DNS response, it follows the chain of trust from the root down to verify signatures

DNSSEC Record Types

Record Type	Purpose
`DNSKEY`	The zone's public signing key
`DS`	Hash of the child zone's DNSKEY, stored in the parent zone
`RRSIG`	Cryptographic signature over a set of DNS records
`NSEC` / `NSEC3`	Proof that a record does not exist (denial of existence)

The Chain of Trust

DNSSEC creates a chain of trust from the root zone down to individual domains:

Root zone (.) ← Trust anchor, key is published by IANA
  └─ .com zone ← Signed, DS record in root zone
       └─ example.com ← Signed, DS record in .com zone
            └─ DNS records ← Signed with example.com's key

The root zone's key (the "trust anchor") is built into DNSSEC-validating resolvers. This is the starting point of all verification.

DNSSEC Does NOT Encrypt Traffic

A common misconception: DNSSEC authenticates DNS responses but does not encrypt them. DNS queries and responses are still sent in plaintext. For privacy, use:

DNS-over-HTTPS (DoH) — encrypts DNS traffic over HTTPS
DNS-over-TLS (DoT) — encrypts DNS traffic over TLS

How to Enable DNSSEC for Your Domain

Check that your DNS hosting provider supports DNSSEC signing
Enable DNSSEC signing in your DNS provider's control panel
Your provider generates DNSKEY records and signs your zone
Copy the DS record values shown by your DNS provider
Submit the DS record to your domain registrar (usually via their control panel)
Wait for propagation (can take up to 48 hours)

Check Your DNSSEC Status

Check DNSSEC →Next: What is DNS TTL? →

Try it on your domain

See the theory in practice — run a DNSSEC Check for your own domain.