Glossary
SECURITY

DNSSEC

DNS Security Extensions — a suite of records (DNSKEY, RRSIG, DS, NSEC/NSEC3) that cryptographically signs DNS answers, preventing forgery.

DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS answers so recursive resolvers can detect tampering. Without DNSSEC, a resolver has no way to know whether a DNS answer was modified in transit or forged by a cache-poisoning attacker.

The Record Types

  • DNSKEY — public key(s) used to sign the zone
  • RRSIG — signature over a record set, produced with the DNSKEY private key
  • DS — hash of the child’s DNSKEY, published in the parent zone
  • NSEC / NSEC3 — proof of non-existence for NXDOMAIN answers

Chain of Trust

Root zone (trust anchor) → .com DS → example.com DS → example.com DNSKEY → signed record sets. Break any link and validation fails.

Why Adoption Is Low

  • Deployment is finicky — a bad rotation SERVFAILS the whole zone.
  • Most stub resolvers don’t validate; only ~30% of recursive resolvers do (mostly Google 8.8.8.8, Cloudflare 1.1.1.1, Quad9).
  • Browsers don’t require DNSSEC. HTTPS + certificate transparency does most of the trust-anchoring work in practice.

Where It Matters

DNSSEC is prerequisite for DANE (TLSA records) and for MTA-STS variants that pin certs via DNS.

Check the DS record glossary entry, read every major DNS record type, and see the TLSA glossary entry.

← All terms Learning hub →