DNSSEC
/ DNS-sec /
Ordinary DNS has a scary weakness: when a resolver gets an answer, it cannot tell whether it really came from the rightful owner or from an attacker who forged it. Since classic DNS answers are unauthenticated, a man-in-the-middle or a poisoned cache could feed you the wrong address for your bank and you would never know. DNSSEC, the DNS Security Extensions, closes that gap by adding cryptographic signatures so a resolver can verify that an answer is genuine and unmodified.
Concretely, zone owners sign their records with a private key, attaching signature records (RRSIG) that a resolver can check using the zone's public key (published in DNSKEY records). The trick is trust: how do you trust the zone's key? Each level vouches for the level below it. The parent zone publishes a small fingerprint of its child's key (a DS record), so .com vouches for example.com, the root vouches for .com, and you start from a single, widely known root key. This unbroken parent-to-child signing path is called a chain of trust, and a validating resolver follows it from the root down to confirm the answer.
Why it matters: DNSSEC defends the integrity and authenticity of DNS data — it lets you detect forged or tampered answers and reject them. But be honest about what it does not do. DNSSEC signs records; it does not encrypt them, so it provides no privacy — anyone watching can still see which names you look up (that is what DNS over HTTPS and DNS over TLS address). It also only protects DNS data itself, not your later connection to the site, and its deployment is still partial across the Internet.
A validating resolver looks up bank.example with DNSSEC: it checks the RRSIG on the answer using example's DNSKEY, confirms example's key via the DS record in .com, confirms .com via the root, and only then trusts the address. A forged reply would fail a signature check and be rejected.
A chain of signatures from the root down proves an answer is genuine.
DNSSEC provides authenticity and integrity, not confidentiality. It does not hide which names you query — that is the job of DNS over HTTPS / DNS over TLS. The two solve different problems and are often combined.