What is DNSSEC?

DNSSEC (DNS Security Extensions) adds digital signatures to DNS records, so resolvers can prove an answer came from the zone owner unaltered.

Plain DNS has no way to tell a genuine answer from a forged one: an attacker who can inject a reply first, or poison a resolver's cache, can send users to the wrong address. DNSSEC fixes this with public-key cryptography, defined mainly in RFCs 4033 to 4035. Each signed zone publishes its public keys in DNSKEY records, and every set of records gets an RRSIG record containing its signature. To trust a zone's keys, the resolver checks a DS record held in the parent zone, which is a hash of the child's key and is itself signed by the parent. Following DS records upwards links every zone to the root zone, whose key validating resolvers already trust. Signed "this name does not exist" answers use NSEC or NSEC3 records, so even an NXDOMAIN can be proven.

DNSSEC provides authenticity and integrity, not privacy: queries and answers are still readable on the wire. The validation work is done by the recursive resolver, not usually by your laptop. When validation fails, the resolver returns SERVFAIL rather than the forged or broken answer, which is the most common way engineers meet DNSSEC: a domain suddenly stops resolving because its signatures expired or its DS record in the parent no longer matches the key after a key change. Not every zone is signed, and an unsigned zone simply resolves as before. Tools like dig +dnssec show the extra records. The Linux Network Connectivity lesson covers how to read DNS response statuses when troubleshooting.