DNSSEC
DNSSEC adds signatures to DNS answers so a validating resolver can tell whether a response was tampered with.
What DNSSEC does
DNSSEC attaches cryptographic signatures to DNS records. A validating resolver checks those signatures and refuses to return an answer that fails, which is what makes cache poisoning and on-path tampering detectable.
It authenticates the data, not the transport. DNSSEC-signed answers still travel in plain text, and DNSSEC is orthogonal to DNS-over-HTTPS or DNS-over-TLS, which encrypt the query.
The chain of trust
Each zone signs its records, and its parent publishes a DS record that fingerprints the child's signing key. Validation walks from the root down, checking each link.
This is why enabling DNSSEC means work in two places: signing the zone at your DNS provider, and publishing the DS record through your registrar. A signed zone with no DS record at the parent is not validated by anyone.
The AD flag
A validating resolver sets the Authenticated Data flag on responses it successfully validated. That flag is what most lookup tools, including ours, report as DNSSEC status.
An absent AD flag is not proof that a zone is unsigned — it may mean the resolver did not validate. This is why a careful tool reports "not detected" rather than "disabled".
What DNSSEC does not do
DNSSEC does not make DNS private. Anyone on the path can still see which names are being looked up.
A broken signature takes a domain offline for validating resolvers, which is a real operational risk. Expired signatures and DS records left behind after a nameserver migration are the usual causes.