What Is DNSSEC?
DNSSEC stands for DNS Security Extensions. It is a set of protocols that add cryptographic signatures to DNS records. When a DNS resolver supports DNSSEC validation, it can verify that a DNS response is authentic and has not been tampered with between the authoritative server and the resolver.
Standard DNS was designed without built-in security. Responses are accepted at face value, which makes DNS vulnerable to attacks like cache poisoning, where a malicious actor injects forged records into a resolver's cache. DNSSEC was created to address this gap by allowing responses to be cryptographically verified.
How DNSSEC works
DNSSEC works by adding new record types to DNS zones:
- RRSIG (Resource Record Signature): contains the cryptographic signature for a set of DNS records.
- DNSKEY: holds the public key used to verify RRSIG signatures.
- DS (Delegation Signer): published in the parent zone, it links to the child zone's DNSKEY, creating the chain of trust.
- NSEC / NSEC3: proves that a queried name does not exist (authenticated denial of existence).
The chain of trust
DNSSEC relies on a hierarchical chain of trust that starts at the DNS root zone. The root zone is signed, and it contains DS records for each top-level domain (TLD). Each TLD zone is signed and contains DS records for second-level domains, and so on.
For example, to validate example.com:
- The root zone's DNSKEY is trusted (the trust anchor).
- The root zone has a DS record for
.com, linking to the.comzone's DNSKEY. - The
.comzone has a DS record forexample.com, linking toexample.com's DNSKEY. - The
example.comzone signs its records with its private key, and the resolver can verify using the public DNSKEY.
If any link in this chain is missing or invalid, the validation fails.
What DNSSEC does and does not do
| DNSSEC does | DNSSEC does not |
|---|---|
| Verify DNS responses are authentic | Encrypt DNS queries or responses |
| Prevent cache poisoning attacks | Hide which domains you are querying |
| Prove a domain name does not exist | Protect against DDoS attacks on DNS |
| Build a verifiable chain of trust | Replace TLS/SSL for website security |
Limitations and challenges
- Operational complexity: signing zones, managing key rollovers, and ensuring the DS record is correctly published at the registrar all require careful management.
- Larger DNS responses: DNSSEC signatures increase the size of DNS responses, which can cause issues with firewalls or networks that block large UDP packets.
- Partial adoption: DNSSEC is only effective when both the domain and the resolver support it. If the resolver does not validate, signatures are ignored.
- Breakage risk: misconfigured DNSSEC (expired signatures, missing DS records) can make a domain completely unresolvable for validating resolvers.
How to check DNSSEC
You can check whether a domain has DNSSEC enabled using several methods:
- Use IPLookupHub's DNSSEC Checker to quickly see if a domain has active DNSSEC records.
- Run
dig example.com DNSKEY +dnssecto check for DNSKEY records. - Run
dig example.com DSagainst the parent zone to check for the delegation signer record. - Check the domain's registrar control panel — most registrars show whether DNSSEC is enabled.
Frequently asked questions
What is DNSSEC?
DNSSEC (DNS Security Extensions) is a set of extensions to DNS that adds cryptographic signatures to DNS records. It allows resolvers to verify that DNS responses are authentic and have not been modified.
Does DNSSEC encrypt DNS queries?
No. DNSSEC signs DNS data to prove authenticity, but it does not encrypt queries or responses. DNS traffic is still visible unless encrypted by a separate mechanism like DNS-over-HTTPS or DNS-over-TLS.
What attacks does DNSSEC prevent?
DNSSEC helps prevent cache poisoning and man-in-the-middle attacks that inject forged DNS responses. It ensures the response came from the authoritative source and was not altered in transit.
Do all domains use DNSSEC?
No. DNSSEC adoption varies widely. Many large organizations and government domains use it, but a significant number of domains have not deployed DNSSEC because it adds operational complexity.
How do I check if a domain has DNSSEC?
You can use IPLookupHub's DNSSEC Checker tool, query for DNSKEY or DS records using dig, or check the domain's registrar settings for DNSSEC status.