Glossary

DNSSEC (DNS Security Extensions)

Adds cryptographic signatures to DNS responses to prevent tampering

DNSSEC (DNS Security Extensions) is a suite of IETF standards that adds digital signatures to DNS records, allowing resolvers to verify that DNS responses are authentic and have not been tampered with or forged during transit.

What is DNSSEC?

DNSSEC, or DNS Security Extensions, is a set of protocols defined in RFC 4033, 4034, and 4035 that extend the Domain Name System to include cryptographic authentication of DNS data. The standard DNS protocol was designed for reliability rather than security, and it has no built-in mechanism to verify that a response has not been modified or fabricated by an attacker.

DNSSEC addresses this by having zone operators sign their DNS records with private keys. Resolvers that support DNSSEC can then validate responses using the corresponding public keys, which are published in the DNS hierarchy itself. If validation fails, the resolver refuses to return the answer, protecting users from being redirected to malicious servers.

DNSSEC is particularly important for protecting sensitive DNS records such as MX records (which determine where email is delivered) and the TXT records used for SPF, DKIM, and DMARC, since forging these could allow an attacker to intercept email or bypass authentication entirely.

How Does DNSSEC Work?

DNSSEC introduces several new DNS record types to carry cryptographic data. The DNSKEY record holds the zone's public signing key. The RRSIG record contains a cryptographic signature over a specific DNS record set. The DS (Delegation Signer) record, published in the parent zone, creates a chain of trust from the parent to the child zone. The NSEC and NSEC3 records provide authenticated denial of existence for records that do not exist.

When a DNSSEC-validating resolver receives a DNS response, it retrieves the RRSIG for the record set and verifies it using the DNSKEY from the same zone. It then checks that the DNSKEY is trusted by validating the DS record in the parent zone, and so on up the chain to the root zone, whose trust anchor is pre-configured in resolvers. This creates an unbroken chain of trust from the DNS root to the individual record.

If any signature in the chain is invalid or missing, the resolver returns a SERVFAIL error rather than an unvalidated answer.

How to Check Your DNSSEC Status

You can verify whether your domain has DNSSEC enabled and whether validation is working correctly using the DNSSEC Checker at nslookup.net/tools/dnssec-checker. Enter your domain and the tool will check for the presence of DNSKEY and DS records, verify that RRSIG signatures are valid and not expired, and confirm that the chain of trust to the root is intact.

If you are enabling DNSSEC for the first time, verify the setup at your registrar and re-check within 24 to 48 hours to confirm DNS propagation has completed.

Related Tool

DNSSEC Checker

Try the Tool →

Frequently Asked Questions

Does DNSSEC encrypt DNS queries?

No. DNSSEC provides data integrity and authentication — it proves that a DNS response has not been altered — but it does not encrypt DNS traffic. Anyone who can observe the network can still see what domains you are querying. For DNS query privacy, DNS over HTTPS (DoH) or DNS over TLS (DoT) are the appropriate technologies.

What is the chain of trust in DNSSEC?

The chain of trust is a hierarchical path of cryptographic validation that starts at the DNS root zone, which has a well-known trust anchor pre-installed in validating resolvers. Each parent zone signs a DS record that contains a hash of the child zone's DNSKEY. A resolver validates the child zone's signatures by checking that its DNSKEY matches the DS record in the parent, and repeats this process from the root down to the queried domain.

What happens if a DNSSEC signature expires?

DNSSEC signatures have a validity period specified in the RRSIG record. If signatures are not re-signed before they expire, validating resolvers will return SERVFAIL for all queries to that zone, effectively making the domain unreachable. Automatic key rollover and signature refresh are critical operational requirements for any zone that has enabled DNSSEC.

Is DNSSEC required for email authentication?

DNSSEC is not strictly required for SPF, DKIM, or DMARC to work, but it significantly strengthens them. Without DNSSEC, an attacker capable of poisoning DNS caches could replace your SPF or DKIM TXT records with forged values, bypassing email authentication. DNSSEC ensures that the records retrieved by mail servers during authentication checks are genuine.