Search... ⌘ K
Get Started Contact Sales

What Is DNSSEC and How Does It Work?

Last updated

DNSSEC (Domain Name System Security Extensions) adds digital signatures to a domain’s DNS records. A resolver that validates DNSSEC checks each answer’s signature against the domain’s public key and rejects any answer that was forged or changed on the way. When you enable DNSSEC at DNSimple, we create the keys and sign your zone for you.

The meaning of DNSSEC

DNSSEC stands for Domain Name System Security Extensions. It’s part of DNS security best practices, because it adds a layer of security to DNS by allowing DNS records to be digitally signed. This helps ensure that the responses users receive from a DNS lookup are authentic and haven’t been tampered with along the way.

Without DNSSEC, attackers can exploit vulnerabilities in DNS to redirect users to malicious sites, even if everything looks normal. With DNSSEC, DNS resolvers can perform authentication to confirm the integrity of DNS records using cryptographic signatures.

Want to learn about DNSSEC from a taco? Check out our DNSSEC comic for a fun explanation, and get answers to your burning questions on what DNS security is and how DNSSEC helps ensure DNS protection.

Why DNSSEC is a good DNS security tool

Although DNS is a fundamental part of the Internet’s infrastructure, it lacks built-in security to verify that the information it returns is authentic or unchanged. This makes it possible for attackers to manipulate DNS responses and redirect users without them ever knowing.

DNSSEC addresses this by allowing resolvers to validate the origin of DNS data. It ensures that what you receive genuinely comes from the correct source and hasn’t been altered in transit. If you want to use secure DNS, we recommend enabling DNSSEC.

How does DNSSEC work?

When DNSSEC is enabled for a domain, it adds an extra layer of information to DNS responses, allowing resolvers to verify that each answer is authentic. To learn more about the concepts mentioned here, see The DNSSEC Chain of Trust.

What happens behind the scenes

  1. The domain’s DNS records are digitally signed with the zone’s private key. Each signature is stored in an RRSIG record that resolvers use to check the records’ authenticity. Learn more about RRSETs and RRSIGs in DNSSEC.
  2. The domain also publishes DNSKEY records. These contain the public keys that resolvers use to verify signatures, like a public lock that matches the private key used to sign the records.
  3. The parent zone (for example, .com) publishes a DS record. This is a fingerprint of the domain’s key-signing key, which connects the domain’s keys to the parent zone and builds a chain of trust.
  4. When a resolver queries the domain, it checks the DNSKEY and DS records to verify that the signature is valid and trusted.
  5. If everything checks out, the resolver returns the DNS result to the user. If not, the resolver discards the answer and returns an error (SERVFAIL) instead.

What happens if DNSSEC is not enabled?

Without DNSSEC, DNS responses are not cryptographically signed. This means resolvers have no way to verify that the data they receive is authentic. Attackers can exploit this through cache poisoning or man-in-the-middle attacks, redirecting your visitors to malicious sites without any visible indication that something is wrong. With DNSSEC enabled, resolvers that validate signatures reject tampered responses instead of passing them on.

Is DNSSEC outdated?

DNSSEC is not outdated. The protocol is actively maintained by the IETF, with RFC 9364 (published in 2023) consolidating the current standard. Encrypted DNS protocols like DNS over HTTPS (DoH) and DNS over TLS (DoT) serve a different purpose: they protect the connection between a device and its resolver, not the data itself. DNSSEC and encrypted DNS are complementary. DNSSEC verifies that DNS data is authentic, while DoH and DoT prevent eavesdropping on queries.

Should you enable DNSSEC?

If your domain’s TLD supports DNSSEC, enabling it is a recommended security best practice. DNSSEC protects your visitors from being redirected to malicious sites through DNS tampering. At DNSimple, enabling DNSSEC is straightforward - see Enable DNSSEC for step-by-step instructions. Before enabling, review DNSSEC Compatibility With Other DNSimple Features to confirm your setup is compatible.

Learn more about DNSSEC

For a comprehensive overview of DNSSEC at DNSimple, see DNS Security Extensions (DNSSEC) at DNSimple. To explore DNSSEC terms and definitions, check out our DNSSEC Glossary.

Have more questions?

If you have any questions about DNSSEC and how it works to keep your DNS secure, contact support, and we’ll be happy to help. You can also read more about DNSimple Enterprise.