DNSSEC Explained — How DNS Security Extensions Protect Your Browsing

Every time you visit a website, your device performs a DNS lookup to translate the domain name into an IP address. But how do you know the response is authentic? What if someone intercepted the DNS query and sent you to a fake website designed to steal your credentials? This is where DNSSEC — Domain Name System Security Extensions — comes in.

DNSSEC adds a layer of cryptographic verification to the DNS. It ensures that the DNS records your device receives are exactly what the domain owner published and have not been tampered with during transit. In a world where DNS attacks are increasingly common, DNSSEC is one of the most important security measures you can enable.

This guide covers everything you need to know about DNSSEC: how it works, the chain of trust, validation process, provider support, and how it fits into your overall DNS security strategy.

What Is DNSSEC?

DNSSEC stands for Domain Name System Security Extensions. It is a suite of specifications published by the IETF that add cryptographic authentication to DNS responses. The core problem DNSSEC solves is simple: the original DNS protocol, designed in 1983, includes no mechanism to verify the authenticity of DNS data. Any device between you and the DNS resolver can forge a response and redirect you to a malicious server.

DNSSEC solves this by adding digital signatures to DNS records. When a domain owner publishes their DNS records, they also sign them with a private cryptographic key. DNS resolvers that perform DNSSEC validation use the corresponding public key to verify that the records are authentic. If the signature does not match, the resolver discards the response and returns a SERVFAIL error instead of delivering potentially tampered data.

It is important to understand what DNSSEC does and does not do. DNSSEC provides data origin authentication and data integrity. It proves that the DNS records came from the authoritative source and were not modified. It does not provide confidentiality — the DNS records themselves are still sent in plain text. For encryption, you need DNS over HTTPS or DNS over TLS. DNSSEC and encrypted DNS are complementary technologies that work best together.

The Chain of Trust

The foundation of DNSSEC is the chain of trust. Rather than validating every DNS record against a standalone key, DNSSEC builds a hierarchical chain starting from the DNS root zone and extending down to individual domain records. Each level in the chain vouches for the next, creating an unbroken path of cryptographic verification.

Root Zone

At the top of the chain is the DNS root zone, managed by ICANN. The root zone is signed with DNSSEC, and its public key — the Root Signing Key — is distributed with DNS resolver software. This is the trust anchor. Every DNSSEC validation ultimately depends on the integrity of this root key.

Top-Level Domains

Below the root are TLDs like .com, .org, .net, and country codes like .uk and .de. Each TLD publishes a DS (Delegation Signer) record in the root zone. The DS record contains a hash of the TLD's public signing key. When a resolver validates a .com domain, it uses the root zone's signature to verify the .com DS record, then uses the .com public key to verify the domain's records.

Second-Level Domains

At the bottom are individual domains like example.com. The domain owner signs their DNS records (A, AAAA, MX, CNAME) with their private key. The corresponding public key is published as a DNSKEY record. The parent TLD holds a DS record that links to this DNSKEY. A resolver can walk this chain from root to domain, verifying each signature along the way.

Supported DNS Record Types

DNSSEC introduces several new DNS record types to support this system:

• RRSIG — Resource Record Signature. Contains the digital signature for a set of DNS records.
• DNSKEY — Contains the public signing key for a zone.
• DS — Delegation Signer. Links a child zone to its parent by containing a hash of the child's DNSKEY.
• NSEC/NSEC3 — Provides authenticated denial of existence. Proves that a specific DNS record does not exist.
• CDNSKEY/CDS — Child-to-parent signaling records used for automating key rollovers.

How DNSSEC Validation Works

When a DNSSEC-validating resolver receives a DNS response, it performs a series of checks before returning the result to the client. Here is the step-by-step process:

1. Query Initiation

Your device sends a standard DNS query to its configured resolver. The resolver acts as a DNSSEC-validating recursive resolver — typically one of the major public resolvers like Cloudflare, Google, or Quad9.

2. Signature Retrieval

The resolver queries the authoritative nameserver for the requested record. If the zone is DNSSEC-signed, the nameserver returns the requested record along with its RRSIG record. The resolver also retrieves the DNSKEY records for the zone.

3. Signature Verification

The resolver uses the public key from the DNSKEY record to decrypt the hash in the RRSIG record. It then computes its own hash of the returned DNS records and compares the two. If they match, the records are authentic and unmodified.

4. Chain Verification

The resolver verifies that the DNSKEY record itself is trustworthy by checking the DS record in the parent zone. It repeats this process recursively up the hierarchy until it reaches the root zone, where the trust anchor is hardcoded into the resolver software.

5. Response to Client

If all signatures validate correctly, the resolver returns the DNS response to your device with the Authentic Data (AD) flag set to indicate that DNSSEC validation passed. If validation fails, the resolver returns SERVFAIL and your browser shows a DNS error.

This entire process happens in milliseconds. Modern resolvers cache DNSSEC records aggressively, so the validation overhead is negligible for subsequent queries.

Benefits and Limitations of DNSSEC

What DNSSEC Protects Against

DNSSEC is designed to prevent several specific types of DNS attacks:

• DNS spoofing — An attacker intercepts a DNS query and sends a forged response pointing to a malicious server. DNSSEC signatures make this detectable.
• Cache poisoning — An attacker injects fake DNS records into a resolver's cache. DNSSEC-validating resolvers reject unsigned or incorrectly signed records.
• Man-in-the-middle attacks — An attacker between your device and the resolver modifies DNS responses in transit. Signature verification catches any tampering.
• Pharming — Redirecting users to fraudulent websites by manipulating DNS data. DNSSEC prevents unauthorized DNS changes.

What DNSSEC Does Not Protect Against

DNSSEC is not a complete security solution. It has important limitations:

• No encryption — DNSSEC does not hide DNS queries from eavesdroppers. Use DoH or DoT for privacy.
• No DDoS protection — DNSSEC does not prevent denial-of-service attacks against DNS infrastructure.
• Registrar-level attacks — If an attacker compromises your domain registrar account, they can change NS records and generate valid DNSSEC signatures for their own servers.
• Zone enumeration — NSEC records can be used to enumerate all records in a zone (NSEC3 mitigates this but does not eliminate it entirely).
• Adoption gaps — Many domains are still not DNSSEC-signed, and some ISPs do not perform DNSSEC validation.

Which DNS Providers Support DNSSEC?

Most major public DNS resolvers support DNSSEC validation. Here is how the top providers compare:

If you want DNSSEC protection, switch to one of the public resolvers listed above. You can test your current resolver's DNSSEC support using our DNS leak test tool or a dedicated DNSSEC checker.

How to Check If DNSSEC Is Working

There are several ways to verify that DNSSEC is functioning on your connection:

Using Online Tools

Visit dnsviz.net or Verisign's DNSSEC debugger. Enter the domain you want to test, and the tool shows the full DNSSEC validation chain, including signatures, keys, and any errors.

Using the Command Line

If you have dig installed, run: dig example.com +dnssec. Look for the ad flag in the response header. If present, DNSSEC validation passed. You can also check the RRSIG records directly to see the signatures.

Using Browser Extensions

Extensions like DNSSEC/TLS Validator for Chrome and Firefox show whether your current connection uses DNSSEC and/or DNS over HTTPS. These are useful for real-time verification while browsing.

Testing Your Resolver

Some DNS providers offer status pages that show whether your queries are being validated. Cloudflare provides a test page at 1.1.1.1/help that shows DNSSEC status along with other connection details.

How to Enable DNSSEC on Your Domain

If you own a domain, enabling DNSSEC protects your visitors from DNS spoofing attacks. The process varies by registrar and DNS hosting provider, but the general steps are:

1. Generate a Signing Key Pair

Your DNS hosting provider generates a public-private key pair. The private key is used to sign your DNS records. The public key is published as a DNSKEY record in your zone.

2. Sign Your Zone

The provider signs all your DNS records with the private key, creating RRSIG records for each record set. This is typically automated by modern DNS providers.

3. Publish DS Record with Your Registrar

A DS (Delegation Signer) record — a hash of your DNSKEY — must be submitted to your domain registrar. The registrar adds this to the parent TLD zone, completing the chain of trust. This is the step most commonly missed during DNSSEC setup.

4. Verify Propagation

After the DS record propagates, use a DNSSEC debugger to confirm that the full chain validates correctly. Propagation typically takes 15-60 minutes but may take longer depending on TTL settings.

Most modern DNS providers — including Cloudflare DNS, Google Cloud DNS, and AWS Route 53 — offer one-click DNSSEC enablement. The process is fully automated: they generate keys, sign the zone, and provide the DS record for you to submit to your registrar.

DNSSEC vs Encrypted DNS (DoH/DoT)

A common point of confusion is the relationship between DNSSEC and encrypted DNS protocols like DNS over HTTPS and DNS over TLS. They solve different problems and are complementary:

For maximum security, use both DNSSEC and encrypted DNS. DNSSEC ensures the DNS records are authentic. DoH or DoT ensures your queries remain private during transit. Providers like Cloudflare, Quad9, and NextDNS support both DNSSEC validation and encrypted DNS on their endpoints.

DNSSEC FAQ