DNSSEC
In network security, DNSSEC is a set of extensions that let a validating resolver confirm a DNS answer came from the zone’s owner and was not altered in transit. It gives authenticity and integrity, not confidentiality: the query and answer still travel in clear text. Encrypting the lookup itself is the job of DoH, DoT or DoQ.
What it is
DNS (Domain Name System) is the infrastructure that translates the domain names a person types into the IP addresses machines work with. It rests on a hierarchy of servers, from the root to the top-level domains and from there to the authoritative servers of each domain, and it is the first lookup almost any connection makes.
That lookup was born with no protection, so a forged answer was enough to take a user to a site that was not the one they wanted. DNSSEC (DNS Security Extensions) is what corrects it: it signs the data of a zone cryptographically and chains trust from the root.
That the extension exists does not mean it is in place. Adoption is still patchy, and key management and key rotation are the part that stalls in a real estate.
How it works
DNSSEC does not sign responses on demand. It signs the data of a zone: each set of records (an RRset) is signed with the zone’s key, and those signatures are precomputed and published alongside the records. Trust flows downward from the root: a parent zone publishes a delegation-signer record that vouches for the child’s key, forming a chain a resolver can follow from the root to the name it is looking up. The party that checks all of this is the validating resolver, not the end client, which relies on the resolver’s verdict. The effect is that a tampered or forged answer fails validation and is rejected, closing off cache poisoning and forged replies.
What goes wrong
The most expensive misunderstanding in the market is that DNSSEC encrypts DNS. It does not. It proves an answer is genuine; it does nothing to hide the query, so an observer on the path still sees exactly which names are being looked up. Confidentiality is a separate control provided by DNS over HTTPS, DNS over TLS or DNS over QUIC. From an attacker’s side, an estate that deployed DNSSEC believing it protects privacy has still leaked its lookups, and one that skipped it entirely remains open to the forged-answer attacks that enable DNS hijacking. Deployment is also uneven: signing a zone helps nobody unless resolvers actually validate.
Where this shows up in an audit
We check both halves separately: whether the zone is signed and the chain of trust is intact, and whether resolvers validate, because a signed zone with non-validating resolvers gives integrity to no one. We also record that DNSSEC is not a confidentiality control and flag where lookups travel in clear text if privacy is a requirement. DNSSEC uses the same digital signature machinery as the rest of public-key cryptography. This is part of how we check DNS integrity on the perimeter.