What is DNSSEC? Guide to Domain Name System Security Extensions

Key takeaways:

• DNSSEC uses digital signatures to confirm that DNS data is authentic and unchanged.
• It helps protect your visitors from DNS spoofing, cache poisoning, and fraudulent redirects.
• To enable DNSSEC, activate it with your DNS provider, publish the DS record through your registrar, and verify the setup.

Every time a customer types your website name into their browser, the Domain Name System (DNS) translates that name into an IP address. Arguably, though, standard DNS isn’t built with tight security. Hackers can sometimes tamper with the connection.

Domain Name System Security Extensions (DNSSEC) help make the DNS more secure by acting like a digital check for your website, so your visitors always land on your real page and not a fake one.

In this guide, you’ll learn what and how DNSSEC works, and why setting it up is a smart move for your small business.

What is DNSSEC?

Domain Name System Security Extensions (DNSSEC, also called DNS Security Extensions) are security protocols that protect the information your site sends to browsers. To put it simply, DNSSEC is a way to prove that your website’s data is authentic.

Traditional DNS lacks built-in security or authentication. When someone types your domain, DNS processes requests and returns information that tells the browser where to find your site. This information is contained in DNS records and delivered through DNS responses.

DNSSEC uses digital signatures to verify those DNS responses. It ensures that data integrity and authenticity of DNS responses truly come from the correct source. It acts as a safeguard.

Think of it as a wax seal on an envelope. It verifies that your DNS responses haven’t been opened or changed in transit. It protects against DNS spoofing, DNS cache poisoning, and other attacks that rely on forged DNS responses.

Even better, it works alongside existing DNS records and DNS infrastructures. You don’t have to overhaul your entire technical setup to use it.

How does DNSSEC work?

The DNSSEC protocol protects your site by adding cryptographic signatures to DNS records. These cryptographic signatures verify your DNS records. They ensure that the information sent to your visitors is exactly what you intended.

DNS records are grouped into RRsets

To better and truly understand DNSSEC, you first need to understand Resource Record Set (RRset).

When DNS stores information for a domain, it organizes similar DNS records into groups of the same DNS record types. An RRset is the collection of DNS records of the same type for the same domain name.

For example, if your website has multiple IP addresses, all of its A records are grouped into one RRset. Likewise, all MX records for email are grouped into another RRset.

Rather than looking at every single record one by one, grouping DNS records makes the process faster. DNSSEC signs the entire RRset at once.

Key DNSSEC records and keys

DNSSEC relies on records and cryptographic keys to verify that your DNS information is authentic and hasn’t been altered.

Think of them as a set of tools that work together to prove your website’s data can be trusted.

Each DNS zone uses a pair of keys: a private key, which is kept secret, and a public key, which is shared so others can verify the data. The zone administrator or DNS provider is responsible for managing these keys.

Here are the key components that make DNSSEC work:

• Private Key: A secret key kept by your DNS provider. It is used to create digital signatures for your DNS data.
• Public Key: A key that is published publicly. DNS resolvers use it to verify that the digital signatures were created by the corresponding private key. If the signature matches, the resolver knows the DNS data is authentic.
• Resource Record Signature (RRSIG): A DNS record that stores the digital signature for an RRset. DNS resolvers check this signature to confirm the DNS data hasn’t been changed since it was signed.
• DNSKEY: A DNS record that stores the public key used for DNSSEC validation. Resolvers use the key in this record to verify the signatures stored in RRSIG records.
• Delegation Signer (DS): A DNS record that helps create DNSSEC’s chain of trust. It links your domain’s DNSSEC information to the trusted DNS records maintained by your domain’s registry. In DNS terms, your domain (such as example.com) is called the child zone, while the domain above it (.com) is the parent zone. This parent and child zone relationship allows DNS resolvers to verify that your DNSKEY record is legitimate.
• Key Signing Key (KSK): A special key used to sign DNSKEY records. It helps prove that the public keys published for your domain are trustworthy.
• Zone Signing Key (ZSK): The key used to sign the actual DNS data in a zone, such as A, AAAA, MX, and other DNS records.

To simplify things, think of it this way:

• The ZSK signs your DNS data.
• The KSK signs the key that validates that data.
• The DNSKEY stores the public keys.
• The RRSIG stores the signatures.
• The DS record connects everything to a trusted source.

Together, these components allow DNS resolvers to verify that your DNS information is authentic and hasn’t been tampered with.

DNSSEC validation process

DNSSEC validation checks a signed DNS answer against a chain of trusted records. You don’t need to do this yourself, as the process happens automatically behind the scenes whenever someone visits your website.

The validation performed by a recursive resolver, which is a server that looks up DNS information on behalf of users. Your internet service provider or a public DNS service such as Google Public DNS typically operates this resolver as part of DNS resolution.

To verify a DNS response, the resolver follows a chain of trust. This is a series of checks that connect your domain’s DNS information all the way back to the trusted DNS root zone.

1. Obtain the DNSKEY records: When a DNS query is made, the resolver first requests the domain’s DNSKEY records, along with the corresponding RRSIG records that contain their digital signatures. A DNSKEY record stores the public key used for DNSSEC verification. The resolver needs this key to check whether the domain’s DNS data was signed by an authorized source. Without the DNSKEY records, DNSSEC validation can’t begin.
2. Verify the DNSKEY: Next, the resolver verifies that the DNSKEY record is trustworthy. It compares the DNSKEY record with the domain’s DS record. The DS record acts like a reference or fingerprint of the DNSKEY and is stored in the domain’s parent zone. (For example: example.com is the child zone; .com is the parent zone.) If the DNSKEY and the information in the parent zone match the DS record, the resolver knows the key is legitimate and has been approved by the parent zone.
3. Verify the DS record: The resolver then checks whether the DS record itself can be trusted. Using the parent zone’s DNSKEY records, it validates the DS record’s signature. This confirms that the link between the parent zone and child zone is authentic.In simple terms, this step verifies that the parent zone is vouching for the child zone’s DNSSEC information.
4. Repeat the process up the DNS hierarchy: The resolver repeats these verification steps at each level of the DNS hierarchy. Validation continues from the domain to the top-level domain (TLD) and ultimately to the DNS root zone. Each level validates the level below it and creates a continuous chain of trust that extends from the website’s domain back to the DNS root, which serves as the foundation of DNSSEC. For example, when validating example.com, the resolver checks:
   • example.com
   • .com
   • The DNS root zone
5. Verify the response: Once the resolver trusts the domain’s DNSKEY, it can verify the RRSIG signature attached to the DNS response. The DNS response contains the requested DNS record or other information requested by the user, such as the IP address of a website. The resolver checks the signature to ensure the response hasn’t been modified in transit.
   • If the signature is valid, the resolver accepts the DNS response and sends it to the user’s browser.
   • If the signature is invalid, the resolver rejects the response and returns an error instead.

DNSSEC strengthens DNS security by making forged or altered DNS responses detectable before a resolver accepts them. The chain of trust gives the resolver a verified path back to the DNS root.

DNSSEC: Chain of trust

To make sure DNS data is trustworthy, DNSSEC creates a “chain of trust” that connects each level of the DNS hierarchy, from the DNS root zone to your domain.

Here’s how it works:

• The zone signing key (ZSK) signs your domain’s DNS records to confirm they’re real.
• The key signing key (KSK) signs the DNSKEY record set, which includes the ZSK’s public key, to show that the signing keys are trustworthy.

The process starts at the root, then checks the TLD like .com, and finally your domain. Each step confirms that the next one is valid and secure. If anything’s altered along the way, the browser knows it’s not trustworthy and will reject the data.

The DNS root zone is the highest level of the DNS hierarchy, so it has no parent zone to verify its information. Instead, the root KSK serves as the starting point of trust for DNSSEC validation.

The Internet Corporation for Assigned Names and Numbers (ICANN), through IANA, oversees the Root Signing Ceremony. This secure, publicly monitored process signs and protects the DNS root’s key information, helping keep root DNS information trustworthy.

Why is DNSSEC important?

DNSSEC is important because it helps protect the DNS lookup that sends visitors to your website. It can block fake DNS responses before they affect your visitors.

Here are more reasons why DNSSEC is a great tool for your website:

• Protects against common DNS attacks
• Verifies DNS data authenticity and prevents tampering
• Protects your brand reputation and builds customer trust
• Works with your existing setup
• Supports compliance and security best practices

Protects against common DNS attacks

DNSSEC helps protect against several common DNS-based attacks, including:

• DNS spoofing: Attackers can redirect your users to fake websites by manipulating DNS records.
• DNS cache poisoning: Malicious persons can flood a DNS resolver with false information, which leads your users to incorrect or harmful websites.
• False zones: Attackers can exploit gaps between DNS zones to provide fake responses.

These attacks damage your website’s reputation and lead to data theft, malware infections, or phishing attempts. DNSSEC validation ensures the legitimacy of DNS responses before they reach users.

Verifies data authenticity and prevents tampering

DNSSEC ensures that the DNS data you receive is authentic and hasn’t been altered during transmission. It verifies the origin of the DNS data and ensures it comes from a legitimate source.

Without DNSSEC, hackers can alter DNS data, and lead to malicious redirection or stealing sensitive information. DNSSEC prevents such tampering and maintains the integrity of DNS responses, boosting user confidence in your website.

Protects your brand reputation and builds customer trust

Phishing, DNS spoofing, and fraudulent redirection can use forged DNS responses to send visitors to fake websites that impersonate your brand. This can damage your reputation, reduce customer confidence, and erode trust in your online services.

DNSSEC validation checks DNS information before visitors reach your site, helping direct them to the intended destination. This added DNS security can benefit e-commerce sites that handle customer accounts or payments and should work alongside other eCommerce security measures.

DNSSEC may also support SEO indirectly by contributing to a safer, more reliable user experience.

Works with your existing setup

DNSSEC is widely recognized as an essential security measure, with organizations like ICANN actively promoting its adoption. Many top-level domains (TLDs) already support DNSSEC, and it’s becoming a standard for website security.

DNSSEC is compatible with existing DNS infrastructure and DNS name servers, meaning it can be easily implemented without requiring major changes to your website’s network or hosting setup. This makes it a practical and effective way to improve your site’s security.

Supports compliance and security best practices

DNSSEC can strengthen your organization’s security posture by protecting DNS infrastructure, a critical part of how people reach your online services. It improves DNS security by helping maintain the authenticity and integrity of DNS data while reducing risks to your domain infrastructure.

Organizations are increasingly expected to use security controls that limit spoofing, tampering, and unauthorized redirection. DNSSEC can support your network security and governance goals by allowing resolvers to reject altered or forged responses. However, DNS security is only one part of your security posture and does not guarantee compliance on its own.

Why isn’t everyone using DNSSEC?

DNSSEC isn’t used everywhere despite the benefits it brings, seemingly because several services must work together. Managed DNSSEC deployment can reduce this work, but it still requires provider support, accurate records, and ongoing monitoring.

Here are key reasons why DNSSEC hasn’t been adopted by most businesses:

• It’s complicated to set up and manage
• The benefits aren’t immediately visible
• It depends on third-party services
• Adoption is uneven
• DNSSEC isn’t a complete security solution
• DNSSEC misconfigurations can create operational challenges

It’s complicated to set up and manage

DNSSEC setup requires coordination between your DNS host and registrar. To implement DNSSEC, the DNS host must sign the DNS zone, and the registrar must publish the matching DS record. Many providers automate these tasks, but you still need to confirm the setup and monitor key changes over time.

The benefits aren’t immediately visible

DNSSEC’s benefits are hard to see because it works in the background. Browsers don’t display a badge like the HTTPS connection indicator, so you may not know that secure DNS validation is working unless you test it. This can make DNS security seem less urgent than visible protections.

It depends on third-party services

A complete DNSSEC setup depends on several third-party services. The provider running the authoritative DNS servers must sign the zone. The registrar or registry must publish the DS record, and DNS resolvers must validate the chain. If one authoritative name server returns outdated information, some users may receive errors.

Adoption is uneven

Organizations have different levels of support for DNSSEC. Large organizations often have specialists to deploy DNSSEC, while small businesses may have tighter budgets or more immediate priorities. Managed DNS can reduce the burden, but availability still depends on the registrar and DNS host.

DNSSEC isn’t a complete security solution

DNSSEC is an important DNS security control, but it doesn’t protect your organization from every cyber threat. It supports secure DNS by protecting DNS data integrity. It doesn’t stop email spoofing, password attacks, or malware. You still need broader network security controls, including email authentication, strong passwords, software updates, and malware detection and removal.

Because DNSSEC addresses a specific problem, some organizations may prioritize more visible protections. Treat DNSSEC as one layer of your security strategy, not a replacement for other controls.

DNSSEC misconfigurations can create operational challenges

DNSSEC improves security, but incorrect DNSSEC implementation or management can make your website unavailable. DNS records, DNSSEC keys, signatures, and DS records must remain accurate and aligned. Changes to your DNS service, nameservers, or keys require careful planning, testing, and monitoring.

The main operational risks include:

• Misconfigurations can affect website accessibility: DNS records, DNSSEC keys, signatures, and the DS record must match across the validation chain. If any value is missing, outdated, or incorrect, DNSSEC validation may fail and prevent visitors from reaching your website.
• Additional administrative overhead: DNSSEC requires ongoing maintenance. You must rotate DNSSEC keys, monitor DNSSEC signatures, update DNS records after changes, and keep the DS record accurate. These tasks continue over time, especially when your DNS setup changes.
• Larger DNS responses: DNSSEC adds DNS records and digital signatures to standard DNS responses. This increases the amount of DNS data sent between servers and resolvers, which may require more network bandwidth and processing resources than standard DNS.
• Potential DDoS amplification concerns: Larger DNS responses can increase amplification risks when DNS infrastructure is poorly managed. Attackers may exploit an open DNS server to generate amplified traffic during a DDoS attack.

How to set up DNSSEC: Step-by-step guide

Many registrars and DNS providers simplify DNSSEC setup, although some configurations may require technical assistance. Here’s a general guide to help you through it:

1. Log in to your account with your domain registrar. Once you’re in, navigate to the dashboard where you can manage your domain settings.
2. Locate the section for DNS settings. Look for the option related to DNSSEC, which may be listed under advanced settings or security features.
3. In the DNS settings section, look for the option to enable DNSSEC. Once activated, DNSSEC uses cryptographic keys managed by your DNS provider to sign DNS records.
4. After enabling DNSSEC, you’ll receive a DS record. This record connects your domain’s security setup to the global DNS system.
5. Some registrars handle this step automatically, but if not, you may need to copy and paste the DS record into your DNS settings. Double-check to ensure this step is completed.
6. To make sure everything is set up correctly, use a trusted DNS diagnostic tool to verify that DNSSEC is working properly. This will confirm that your domain is now better protected against potential threats.

Note: Actual steps may vary per registrar.

Frequently asked questions

Secure your website traffic and build trust

A secure domain helps ensure that visitors always reach your legitimate website. DNSSEC adds protection against forged DNS information, reducing the risk of phishing and other attacks.

But while DNSSEC helps secure your domain, it doesn’t protect the data exchanged between your website and visitors.

For complete protection, pair DNSSEC with an SSL certificate. Explore our SSL certificate options to secure website traffic and create a safer online experience for your customers.

Together, DNSSEC and SSL help strengthen your website’s security, protect customer information, and build long-term trust in your brand.