DNSSEC: definition

DNSSEC adds digital signatures to the answers of the Domain Name System, so a computer can check that an answer comes from the owner of a domain and was not changed on the way. It does not hide anything and does not stop every attack. Turning it on needs the DNS provider, the registrar and the registry The central database and system of a top-level domain, or loosely the organization that runs it. Full definition of registry to work together.

What DNSSEC protects against, in plain words

When someone visits example.com, a resolver looks up its address. Without DNSSEC, an attacker who feeds the resolver a forged answer can send visitors to the wrong server. With DNSSEC, a validating resolver checks the signature and rejects the forgery.

RFC Request for Comments A numbered document in the series recording the internet's technical standards and practices. Full definition of RFC 4033 (March 2005) defines what DNSSEC gives: proof of origin and integrity for DNS data. It gives no confidentiality, so answers stay readable, and no protection against denial of service attacks. It covers DNS answers only, not phishing Impersonating a trusted party to steal data, often with look-alike domains. Full definition of phishing or the takeover of a registrar account. RFC 9364 (February 2023) calls DNSSEC the best current practice for authenticating DNS data; whether to use it for a domain is the owner’s decision.

How the chain of trust works from the root to your domain

A validating resolver starts from one key it already trusts: the trust anchor The key a DNSSEC resolver trusts from the start, normally the root zone's key. Full definition of trust anchor, which is the root zone The top of the DNS, listing every TLD and its name servers. Full definition of root zone’s Key Signing Key, published by IANA Internet Assigned Numbers Authority The functions that coordinate the root zone, IP addresses and protocol numbers. Full definition of IANA. From there it follows a chain:

The root zone holds a signed DS record Delegation Signer A record in the parent zone that links a domain's DNSSEC key to the chain of trust. Full definition of DS record for .com.
That DS record matches a key in the .com zone, which lets the resolver verify the .com records, including the DS record for example.com.
That DS record matches example.com’s key, which verifies the domain’s own records.

A signed zone whose parent holds no DS record is an “island of security”: it cannot be validated from the root.

An answer is secure when every signature checks, insecure when signed proof shows the parent holds no DS record for the zone, and bogus when expected signatures are missing, expired or unusable (RFC 4033). For a bogus answer, the resolver normally returns an error, SERVFAIL Server Failure The DNS answer meaning the lookup failed, often due to broken name servers or DNSSEC. Full definition of SERVFAIL (RFC 4035).

Keys and records: KSK, ZSK, DNSKEY, DS and RRSIG

DNSKEY record A DNS record holding a public key used to check a zone's DNSSEC signatures. Full definition of DNSKEY record records publish a zone’s public keys.
RRSIG Resource Record Signature The DNS record that carries a DNSSEC signature for a set of records. Full definition of RRSIG records hold the signatures, each valid only between a start date and an expiry date.
DS records sit in the parent zone and hold a key tag, an algorithm number and a digest of the child’s key.
The KSK Key Signing Key The DNSSEC key that signs a zone's key set and is referenced by the parent zone. Full definition of KSK signs only the zone’s set of keys, and the parent’s DS record points to it. The ZSK Zone Signing Key The DNSSEC key that signs the ordinary records in a zone. Full definition of ZSK signs everything else.

RFC 6781 (December 2012) notes that validators treat both kinds of key alike: the split is operational, and some zones use one key for both roles.

Proving that a name does not exist needs its own records. NSEC and NSEC3 Next Secure and Next Secure version 3 DNSSEC records that prove a name or record does not exist. Full definition of NSEC and NSEC3 names the next existing name, which lets anyone list the whole zone (“zone walking”). NSEC3 (RFC 5155) hashes the names first, though it still reveals details such as the zone’s size.

Turning DNSSEC on: what the registrar, registry and DNS provider each do

The DNS provider signs the zone and publishes DNSKEY and RRSIG records.
The DS data, or the key data, goes to the registrar.
The registrar sends it to the registry over EPP Extensible Provisioning Protocol The protocol registrars use to manage domain names at registries. Full definition of EPP with the secDNS extension The EPP add-on used to send a domain's DNSSEC data to the registry. Full definition of secDNS extension (RFC 5910, May 2010), either as DS data or as key data from which the registry builds the DS record.
The registry publishes the DS record in the TLD top-level domain The last part of a domain name, after the final dot. Full definition of TLD zone.

When the registrar is also the DNS provider, steps 1 to 3 are often one setting.

For gTLD generic top-level domain A top-level domain not tied to a country, run under ICANN contracts. Full definition of gTLD, the 2013 RAA Registrar Accreditation Agreement The contract between ICANN and each accredited registrar. Full definition of RAA requires registrars to relay requests to add, remove or change key material to registries that support DNSSEC, using RFC 5910. The Base Registry Agreement (approved on 21 January 2024, current as of October 2026) requires gTLD registries to sign their zones and accept key material from child domains. ccTLD country code top-level domain A top-level domain for a country or territory, usually two letters long. Full definition of ccTLD rules differ: check with the registrar or registry.

There is also an automated route: the DNS provider publishes CDS and CDNSKEY Child DS and Child DNSKEY Records a zone publishes so the registry can update its DNSSEC data automatically. Full definition of CDS and CDNSKEY records stating what the DS record should be, and some registries and registrars scan for them. RFC 8078 (March 2017) added a signal to remove DNSSEC; RFC 9615 (July 2024) lets the parent verify these records cryptographically before turning DNSSEC on.

What can go wrong: expired signatures, key rollovers and changes of DNS provider

Expired signatures. RRSIG records not renewed in time make answers bogus.
A DS record with no matching key. RFC 6781 calls this “security lameness”: the domain fails for every validating resolver, and the fix takes time to spread. A KSK change therefore needs the new DS record at the parent before the old key is removed.
Changing DNS provider. The old operator controls the keys. The best method is a coordinated key rollover The planned, step-by-step replacement of a DNSSEC signing key. Full definition of key rollover. If the old operator does not cooperate, the DS record is removed, the name server A server that holds a domain's DNS records and answers lookups. Full definition of name server are changed, and once that has spread the new DS record is added. The domain is unsigned in between, which RFC 8078 prefers to validation failures. Short TTL Time to Live How long resolvers may keep a saved copy of a DNS record. Full definition of TTL help.

Failures appear as SERVFAIL for users of validating resolvers, while the domain may still work for everyone else.

At the root, as of 9 October 2026, ICANN Internet Corporation for Assigned Names and Numbers The nonprofit that coordinates the global DNS and gTLD policy. Full definition of ICANN plans to replace the root KSK on 11 October 2026: KSK-2024 (key tag 38696) takes over from KSK-2017 (key tag 20326), which is to be revoked on 11 January 2027 and removed on 22 March 2027. This concerns operators of validating resolvers, who need the new trust anchor, not registrant The person or organization that holds a domain name registration. Full definition of registrant.

DNSSEC and encrypted DNS: how they differ

DNSSEC signs the data so any resolver can check it, but everything stays readable. DoT DNS over TLS DNS lookups carried over a TLS-encrypted connection on a dedicated port. Full definition of DoT (DoT) and DoH DNS over HTTPS DNS lookups carried inside encrypted HTTPS connections. Full definition of DoH (DoH) encrypt the link between a user’s device and the resolver, which protects privacy, but they do not prove that the data came from the zone owner. The two complement each other.

DNSSEC