DNSSEC: Cryptographic Signing for DNS
DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS records so resolvers can verify that the answer they received actually came from the domain's authoritative source and was not tampered with in transit. It protects against DNS spoofing and cache poisoning — attacks that silently redirect a domain's traffic.
How it works, briefly
The DNS provider signs the zone's records with a private key, and a DS (Delegation Signer) record published at the registry — via your registrar — anchors that key into the TLD's chain of trust. A validating resolver checks signatures up the chain to the root. If validation fails, the resolver returns an error instead of a forged answer.
The gotcha investors and operators hit
A stale DS record breaks a domain hard. If you switch DNS providers or transfer a domain without removing or updating the DS record, validating resolvers will fail every lookup and the domain effectively goes dark. Before changing DNS providers on a DNSSEC-enabled name, remove the DS record, migrate, then re-sign.
Frequently Asked Questions
Does DNSSEC encrypt my DNS traffic?
No. DNSSEC provides authentication (proof records are genuine), not encryption. Queries remain readable; they just cannot be forged without detection.
Do parked or for-sale domains need DNSSEC?
Generally no — there is little to protect on a parked name, and DNSSEC adds a failure mode during transfers. Enable it on domains running real infrastructure.