Glossary · ENCheck a domain

DNSSEC

DNSSEC helps check that DNS answers come from the responsible source and have not been changed. A DNS resolver, the service that looks up DNS answers, checks digital signatures attached to DNS records. These signatures are linked through a chain of trust, so each verified step helps confirm the next. A DNS zone is the part of DNS managed together by a responsible source. DNSSEC helps protect DNS answers from certain kinds of tampering, but it does not encrypt DNS queries or make a website safe.

How does DNSSEC validation work?

A DNS zone publishes public key and signature records. A resolver that checks DNSSEC signatures follows the chain from a trusted starting point, usually the DNS root at the top of the DNS hierarchy. It checks the links between parent zones and the child zones below them. When the chain verifies, the resolver can have greater confidence that the answer comes from the responsible source and has not been changed. If a signed zone has broken signatures or a broken link between parent and child zones, validating resolvers can return an error instead of the expected answer.

For example, a domain owner enables DNSSEC at the DNS provider and publishes the required DS information, which links the parent zone to the domain's keys, through the registrar or registry. When the DS and child-zone keys match and signatures are current, a validating resolver can confirm the chain. Enabling only one part of the chain incorrectly can make the domain fail for users whose resolvers validate DNSSEC.

What does DNSSEC not do?

DNSSEC checks where data comes from and whether it has been changed. It does not keep that data private. Queries and answers are not hidden by DNSSEC. It does not verify that a website's content is honest, stop phishing, or protect a device from malware. It is also different from HTTPS, which protects a connection between a browser and a website.

Related terms