DNSSEC (Domain Name System Security Extensions) is a set of protocols developed by the Internet Engineering Task Force (IETF) that adds a layer of security to DNS by allowing the authentication of DNS data.
This helps protect against attacks such as DNS spoofing or DNS cache poisoning.
How DNSSEC works:
Digital signatures and public-key cryptography
DNSSEC uses public-key cryptography to sign DNS records. Each DNS zone has a pair of cryptographic keys:
- A public key (published in DNS)
- A private key (used to sign DNS records)
These generate digital signatures that validate the authenticity of the DNS data.
Signed DNS records
When a DNS zone has DNSSEC enabled, the records (such as A, MX, etc.) are accompanied by RRSIG records that contain the digital signature.
DNS resolvers also retrieve DNSKEY records, which contain the public key used to verify the signature.
Chain of trust
DNSSEC creates a chain of trust from the root DNS zone down to individual domains:
- The root zone signs the top-level domain (TLD) zone (such as
.com). - The TLD identifies the second-level domain (such as
example.com). - This continues down to subdomains.
Each link in the chain is verified by a Delegation Signer (DS) record, stored in the parent zone.
Validation by resolvers
When a DNSSEC-aware resolver queries a DNS record, it checks the digital signature using the public key.
If the signature is valid and a complete chain of trust exists, the data is considered authentic.
If validation fails, the resolver will reject the response to protect the user.
Note: DNSSEC does not encrypt DNS traffic; it only guarantees that the response you receive is authentic and has not been altered.
Note: To enable DNSSEC, you must have the domain name you want to enable it on registered with us, the domain's nameservers must point to us, and we must host the website for that domain.
If you want to enable DNSSEC for your domain, go to Manage domains > Options > Manage > DNSSEC Protection.
