DNSSEC (Domain Name System Security Extensions) adds digital signatures to DNS data. Ordinary DNS has no built-in way to prove an answer is genuine, so an attacker who can inject responses could redirect traffic or forge records. DNSSEC lets a validating resolver verify that each answer was published by the real domain owner and was not altered in transit.
It works through a chain of trust. Each zone signs its records with a private key and publishes the matching public key as a DNSKEY record. The parent zone vouches for that key with a DS record, and this continues up to the DNS root. If any signature fails to validate, the resolver returns a failure rather than a forged answer.
For email authentication, DNSSEC is important because so much depends on trustworthy DNS lookups: SPF, DKIM, DMARC and MX records are all fetched from DNS. It is also a strict prerequisite for DANE, since a TLSA record is only meaningful when the DNS response carrying it cannot be spoofed.
DNSSEC does not encrypt DNS or hide queries; it only proves authenticity and integrity. To adopt it, enable signing at your DNS provider and publish the DS record at your registrar. Check whether your domain is signed and that the chain of trust validates end to end.
Check it on your domain
- DNSSEC Checker: check whether a domain is signed with DNSSEC.
- DNS Record Checker: look up any DNS record type for a host.