DNSSEC
also: DNSSEC validation, DNSSEC signing
DNSSEC is a security protocol that adds cryptographic signatures to DNS records, allowing clients to verify that DNS responses are authentic and haven't been tampered with.
DNSSEC (Domain Name System Security Extensions) extends the standard DNS protocol with digital signatures and public-key cryptography. It protects against DNS spoofing and cache poisoning attacks where an attacker redirects a domain to a malicious IP address.
DNSSEC works by signing DNS records with private keys at each level of the DNS hierarchy (root, TLD, domain). A resolver can verify these signatures using corresponding public keys, ensuring the response came from the legitimate authoritative server. For example, when you query example.com, DNSSEC validates that the answer actually came from example.com's authoritative nameserver, not an attacker.
To enable DNSSEC for a domain, the administrator generates key pairs, signs zone records, and publishes the public key fingerprint (DS record) at the parent domain. Clients using DNSSEC-validating resolvers receive a status indicating whether records are authenticated, unauthenticated, or invalid.