# What Is DNSSEC (DNS Security Extensions)? Definition and Examples

> DNSSEC is a set of DNS extensions that lets resolvers verify, through a chain of signatures from the root zone, that DNS answers are authentic and unmodified.

Source: https://ssl.sh/glossary/dnssec/
Last updated: 2026-11-10

DNSSEC, specified in RFCs 4033 to 4035, adds digital signatures to DNS. Each signed zone publishes its public keys in DNSKEY records and signs its record sets with RRSIG records; the parent zone publishes a DS record, a hash of the child's key, so trust chains from the root zone (signed since 2010) through the top-level domain down to your domain. NSEC or NSEC3 records give signed proof that a name does not exist. A validating resolver that checks the whole chain marks the answer as authenticated.

## Why it matters
Plain DNS answers can be spoofed or altered, which lets an attacker redirect traffic. For HTTPS, certificates still authenticate the server, but several certificate-related mechanisms depend on honest DNS. [DANE](https://ssl.sh/glossary/dane/) and its [TLSA](https://ssl.sh/glossary/tlsa/) records are meaningless without DNSSEC, and CAs rely on DNS for [CAA](https://ssl.sh/glossary/caa/) lookups and DNS-based domain validation, so a signed zone makes those checks harder to subvert. DNSSEC provides integrity, not confidentiality: queries and answers remain visible in transit. The main operational risk is breaking resolution, for example by switching DNS providers or rotating keys without updating the DS record at the registrar; validating resolvers then return SERVFAIL for the entire domain.

## Example
```bash
dig +dnssec example.com A     # look for RRSIG records and the "ad" flag
dig +short DS example.com     # the DS record published in the parent zone
delv example.com A            # BIND's validating lookup tool; prints "; fully validated"
```

## Common misconceptions
- **DNSSEC encrypts DNS.** It only signs data. Encrypting queries is the job of DNS over TLS or DNS over HTTPS.
- **DNSSEC replaces HTTPS certificates.** Browsers do not use DNSSEC to authenticate web servers; certificates remain necessary.
- **Enabling DNSSEC at the DNS host is enough.** The chain is complete only once the DS record is published at the registrar. When moving DNS providers, plan the key and DS change, or the domain stops resolving for validating resolvers.

## Related terms

- [DANE](https://ssl.sh/zh/glossary/dane/): DANE 是一种利用经 DNSSEC 签名的 TLSA 记录，把 TLS 服务器的证书或公钥与其域名绑定起来的协议。
- [TLSA 记录](https://ssl.sh/zh/glossary/tlsa/): TLSA 记录是一种 DNS 记录，声明某个端口和协议上的 TLS 服务必须出示哪张证书或哪个公钥，供 DANE 校验使用。
- [CAA 记录](https://ssl.sh/zh/glossary/caa/): CAA 记录是一种 DNS 记录，用来声明哪些证书颁发机构可以为该域名签发证书，所有公共 CA 签发前都必须检查。
- [DCV](https://ssl.sh/zh/glossary/dcv/): DCV 即域名控制权验证，是 CA 在签发证书前确认申请者确实控制证书中每一个域名的检查。
- [DNS-01](https://ssl.sh/zh/glossary/dns-01/): DNS-01 是一种 ACME 验证方式，客户端在 _acme-challenge 子域名下发布由 CA 质询计算出的 TXT 记录来证明域名控制权。
- [数字签名](https://ssl.sh/zh/glossary/digital-signature/): 数字签名是用私钥对消息计算出的一个值，任何持有对应公钥的人都能验证它，从而确认消息来源和内容未被篡改。