Domains and DNS

What is DNSSEC and do I need it?

Ordinary DNS answers carry no proof of origin. DNSSEC adds that proof, at the cost of a failure mode where a configuration mistake takes the domain offline for validating resolvers.

DNSSEC (Domain Name System Security Extensions) adds digital signatures to DNS records so that a validating resolver can confirm an answer really came from the domain’s authoritative servers and was not forged or altered in transit. It authenticates DNS data; it does not encrypt it, hide it, or protect the website itself. Whether you need it depends on the domain: it matters most for banks, government and anything attractive to cache-poisoning attacks, and it is optional but low-risk for a small site when the registrar and DNS host support it with one click.

Worked out 2026-10-16 (IST) · DNSSEC as specified in RFC 4033-4035, with validation performed by the visitor’s resolver

The records DNSSEC adds

Four record types
Record	Where it lives	What it does
DNSKEY	In the domain’s own zone	Holds the public key used to verify signatures
RRSIG	Next to every signed record set	The signature over that set of records (an A record set, an MX set and so on)
DS	In the PARENT zone (the .com or .in registry)	A hash of the child zone’s key; it is the link that ties the two zones together
NSEC / NSEC3	In the domain’s own zone	Signed proof that a name does NOT exist, so an attacker cannot forge a "no such domain" answer

How the chain of trust works

A resolver that validates DNSSEC starts from a key it already trusts: the root zone key, which was first signed and published on 15 July 2010. The root vouches for the .com and .in registries through DS records, each registry vouches for the domains under it the same way, and your domain vouches for its own records with RRSIG signatures. If every link verifies, the answer is marked authentic. If any link is missing or wrong, the resolver cannot tell a genuine answer from a forgery and discards it.

What it protects against, and what it does not

Scope
Threat	Does DNSSEC help?
Forged DNS answers (cache poisoning)	Yes - this is exactly what it is for
Someone watching which domains you look up	No - queries are not encrypted
A hijacked registrar or DNS-host account	No - an attacker with account access can publish validly signed bad records
A phishing domain with a similar name	No - a lookalike domain can be perfectly signed
Malware or a hacked web server	No - it only covers DNS data

Should you turn it on?

If your registrar and your DNS host are the same company, or both support it, enabling DNSSEC is usually a single toggle and the provider manages key rotation. In that setup the main risk is the migration trap described above. If the DNS host and registrar are different companies, you must copy the DS record between them by hand, and the manual step is where mistakes happen. For a small content or shop site, the benefit is modest and the downside is rare but severe; for a bank, a public-sector domain or a brand under active phishing attack, it is worth the care. Check what is currently published with the lookup tool, and see what a name server is for who actually controls the zone.

Sources: IETF RFC 4033, RFC 4034 and RFC 4035 (DNSSEC), RFC 8659 (DNS Certification Authority Authorization), and the CA/Browser Forum Baseline Requirements, which have required certificate authorities to check CAA records before issuing since 8 September 2017.

Check your own numbers

Look up a domain’s DNSKEY and DS records to see whether DNSSEC is switched on.

DNS LookupA, AAAA, MX, NS, TXT, CNAME and SOA records, live from the resolver.

Frequently asked

Does DNSSEC make my website more secure?

Not directly. It stops an attacker from silently redirecting your visitors by forging DNS answers, which is a real attack called cache poisoning. It does nothing about malware on your server, weak passwords or a compromised registrar account. Think of it as protecting the address book, not the building.

Does DNSSEC encrypt my DNS queries?

No. Queries and answers still travel in the clear; DNSSEC only attaches signatures that can be verified. Encrypting the lookups themselves is a separate technology, DNS over HTTPS or DNS over TLS, and the two can be used together.

What happens if I get DNSSEC wrong?

A validating resolver will refuse to return any answer for the domain and report SERVFAIL, so the site and its email appear to vanish for every visitor on a validating network, while non-validating resolvers keep working - which makes the failure look intermittent and hard to diagnose. The usual causes are a DS record at the registrar that no longer matches the zone’s key after a provider change, or expired signatures.

Is it safe to change DNS provider or registrar with DNSSEC on?

Only if you plan for it. Before moving, remove the DS record at the registrar (or turn DNSSEC off), wait for the old DS record’s TTL to expire, make the move, then re-enable DNSSEC with the new provider’s keys. Skipping the first step is the single most common way a domain goes dark during a migration.

Need domain and DNS checks inside your own product?

We build WHOIS, RDAP, DNS and SSL lookups as embeddable widgets or a plain JSON API in your branding, wired to your own lead form. Tell us which checks you need and we will send a working demo.