Skip to content

DNSSEC

DNSSEC adds cryptographic authentication to DNS so resolvers can verify that DNS responses are authentic and have not been altered.

DNSSEC, or Domain Name System Security Extensions, adds cryptographic signatures to DNS so resolvers can verify that DNS answers are authentic and have not been altered.

It adds authentication to DNS responses.

Cloudflare describes DNSSEC as a mechanism that digitally signs DNS records to help prevent forged DNS answers from redirecting traffic. Cloudflare's DNSSEC documentation

ICANN also provides a broader overview of why DNSSEC exists and how it protects DNS.

What Problem It Addresses

Normal DNS tells a resolver:

This domain points here.

Without validation, a forged DNS response could potentially try to redirect the request somewhere else.

DNSSEC allows compatible resolvers to verify cryptographic signatures associated with the DNS information.

How It Works

At a high level:

  1. The DNS zone is cryptographically signed
  2. Public signing information is published
  3. A chain of trust connects the domain toward the DNS root
  4. Validating resolvers verify the signatures

The implementation uses additional DNS record types and cryptographic keys.

Most ordinary website owners do not need to manage those details manually when using a provider with automated DNSSEC support.

DNSSEC vs. HTTPS

DNSSEC and HTTPS solve different problems.

DNSSEC → helps verify DNS information.

HTTPS → secures communication between the browser and server.

Using one does not replace the other.

Why Migrations Need Care

DNSSEC is tightly connected to the authoritative DNS configuration.

Changing Nameservers without coordinating DNSSEC can make a domain fail validation and become unreachable to users with validating resolvers.

Cloudflare explicitly warns that nameserver changes with incompatible existing DNSSEC delegation can cause connectivity failures. Cloudflare's nameserver migration guidance

Common Problems

Common problems include:

  • Changing nameservers without updating DNSSEC
  • Old DS record remaining at the registrar
  • DNS provider changed before chain-of-trust information is updated
  • DNSSEC treated as equivalent to TLS
  • Enabling it without understanding who manages the registrar-side record

How to Improve

Use your DNS provider's documented DNSSEC setup.

Before changing authoritative DNS providers:

  1. Review whether DNSSEC is enabled
  2. Follow the provider's migration process
  3. Coordinate registrar and DNS-provider configuration
  4. Verify resolution after the change