DNSSEC

What DNSSEC does

DNSSEC attaches cryptographic signatures to DNS records. A validating resolver checks those signatures and refuses to return an answer that fails, which is what makes cache poisoning and on-path tampering detectable.

It authenticates the data, not the transport. DNSSEC-signed answers still travel in plain text, and DNSSEC is orthogonal to DNS-over-HTTPS or DNS-over-TLS, which encrypt the query.

The records DNSSEC adds

Signing a zone introduces record types that exist only to carry the cryptography. DNSKEY holds the public keys, and RRSIG holds a signature over each set of records, so an answer arrives with the means to verify it.

DS sits in the parent zone rather than the signed one, holding a digest of the child’s key. That placement is what links the two zones, and it is why enabling DNSSEC requires a step at the registrar as well as at the DNS host.

NSEC and NSEC3 answer the harder question of proving that something does not exist, since a signature cannot be attached to a record that was never published.

The chain of trust

Each zone signs its records, and its parent publishes a DS record that fingerprints the child's signing key. Validation walks from the root down, checking each link.

This is why enabling DNSSEC means work in two places: signing the zone at your DNS provider, and publishing the DS record through your registrar. A signed zone with no DS record at the parent is not validated by anyone.

The AD flag

A validating resolver sets the Authenticated Data flag on responses it successfully validated. That flag is what most lookup tools, including ours, report as DNSSEC status.

An absent AD flag is not proof that a zone is unsigned — it may mean the resolver did not validate. This is why a careful tool reports "not detected" rather than "disabled".

Checking whether a domain is signed

dig example.com +dnssec asks for the signatures alongside the answer. RRSIG records coming back means the zone is signed; their absence means it is not.

Signed is not the same as connected. dig DS example.com asks the parent whether it publishes the digest that completes the chain, and a zone that is signed without a DS is not actually validated by anybody.

What DNSSEC does not do

DNSSEC does not make DNS private. Anyone on the path can still see which names are being looked up.

A broken signature takes a domain offline for validating resolvers, which is a real operational risk. Expired signatures and DS records left behind after a nameserver migration are the usual causes.