Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

What Is DNSSEC?

Definition

DNSSEC (Domain Name System Security Extensions) adds digital signatures to DNS records so that resolvers can check the answers they get really came from the domain's owner and were not altered on the way. It protects the integrity of DNS answers. It does not encrypt them or hide which sites you look up.

How It Works

ICANN explains that with DNSSEC "the DNS data itself is signed by the owner of the data." Each signed zone has a key pair:

  1. The zone owner signs its DNS records with a private key and publishes the matching public key in the zone.
  2. A fingerprint of that key (a DS record) is placed in the parent zone, such as .com, through the registrar. This links the domain into a chain of trust that runs up to the DNS root.
  3. A validating resolver, such as the one at your ISP or a public resolver, retrieves the records, the signatures, and the public key, and checks them.
  4. If the signature is valid, the answer is returned. If it fails, the resolver "assumes an attack, discards the data, and returns an error to the user."

RFC 4033, the core DNSSEC standard, is clear about the limits: the extensions "do not provide confidentiality," and "DNSSEC provides no protection against denial of service attacks." It also cannot help if an attacker logs into your DNS or registrar account, because changes made there are signed like legitimate ones. DNSSEC defends against forged answers, not stolen logins.

For most small businesses, turning DNSSEC on is a setting at the DNS host plus a DS record at the registrar. The common failure is during a DNS host change: if the old keys are left at the registrar, validating resolvers reject the domain and it seems to vanish.

Real-World Example

On February 22, 2019, ICANN said it believed "there is an ongoing and significant risk to key parts of the Domain Name System (DNS) infrastructure." Citing "increasing reports of malicious activity targeting the DNS infrastructure," it called for "full deployment of the Domain Name System Security Extensions (DNSSEC) across all unsecured domain names." The announcement came weeks after CISA's Emergency Directive 19-01 on DNS tampering against federal agencies, and alongside a security checklist ICANN offered to registries, registrars, and resellers.

Why It Matters for a Small Business

DNSSEC protects customers and partners from being sent to a fake version of your website or mail server by forged DNS answers. It is usually free, and it pairs well with email protections, such as MTA-STS and DANE, that depend on trustworthy DNS. The bigger risks for most small businesses are a weak registrar login and records nobody watches, so DNSSEC should come after MFA and registrar lock, not instead of them. It also signals to partners and auditors that the domain is managed deliberately rather than left on defaults.

How to Spot It / How DTS Handles It

Warning signs: DNSSEC never enabled, a recent DNS host move with DNSSEC left half-configured, domain resolution failing only for some users, and nobody sure which company holds the registrar account.

DTS can help with checking DNSSEC status, turning on signing where the DNS host supports it, handling key and DS record changes during a DNS host move, and securing the registrar account first. See our managed IT service.

Related Terms

  • DNS hijacking: the account-level attack DNSSEC does not stop.
  • DNS cache poisoning: the forged-answer attack DNSSEC is built for.
  • Domain registrar lock: the account control to set first.
  • MTA-STS: another DNS-based email protection.
  • DMARC: email authentication published in DNS.
  • TLS certificate: encryption for the connection DNS points to.

Sources

  • ICANN, DNSSEC: What Is It and Why Is It Important? (2019): https://www.icann.org/resources/pages/dnssec-what-is-it-why-important-2019-03-05-en
  • ICANN, ICANN Calls for Full DNSSEC Deployment, Promotes Community Collaboration to Protect the Internet (February 22, 2019): https://www.icann.org/news/announcement-2019-02-22-en
  • IETF, RFC 4033: DNS Security Introduction and Requirements (March 2005): https://www.rfc-editor.org/rfc/rfc4033

Last updated October 14, 2026.