DNSSEC
DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS records so a validating resolver can confirm a response actually came from a domain's authoritative owner and wasn't forged or altered in transit. It works by chaining trust from the DNS root down through each parent zone to the domain's own signed records (RRSIG, DNSKEY, and DS records tie the chain together), so a resolver can verify authenticity without a prior trust relationship with that domain. Plain DNS has no such protection, which is what makes cache-poisoning and spoofing attacks possible -- DNSSEC closes that gap, though it guarantees authenticity, not confidentiality, since responses are still sent in the clear. Adoption needs both the domain's DNS provider to sign the zone and the client's resolver to actually validate signatures, so a signed domain can still get unvalidated answers from a resolver that ignores DNSSEC.
By AdminKit team, Netbase JSC · Updated