What Is DNSSEC and How Does It Work
Guide to DNSSEC — how DNS records are signed, what DS/DNSKEY/RRSIG are and how to verify your domain is correctly configured.
What Is DNSSEC?
DNSSEC (DNS Security Extensions) is a set of DNS extensions that adds digital signatures to DNS records. Without DNSSEC, an attacker can poison a DNS cache and redirect visitors to a fake site — even if you have a valid SSL certificate.
With DNSSEC, every DNS response comes with a cryptographic signature proving the data hasn't been tampered with in transit.
How DNSSEC Works
DNSSEC creates a chain of trust from the root zone (.) down to your domain:
- Root Zone (
.) — signed by IANA - TLD Zone (
.com,.gr) — signed by the TLD registry - Domain Zone (
example.com) — signed by you or your DNS provider
Key Record Types
| Record | What it does |
|---|---|
| DNSKEY | Public key for the zone — used to verify RRSIG signatures |
| RRSIG | Digital signature for each DNS record set |
| DS | Hash of DNSKEY published in the parent zone (e.g. in .com) |
| NSEC / NSEC3 | Proves a record does NOT exist (authenticated denial of existence) |
KSK vs ZSK
There are two types of DNSKEY:
- KSK (Key Signing Key): signs the other keys — its hash is published as the DS record in the parent
- ZSK (Zone Signing Key): signs the actual records (A, MX, CNAME etc.) — rotated more frequently
How to Check If Your Domain Has DNSSEC
Validate your domain's DNSSEC chain instantly:
→ DNSSEC ValidatorA correctly configured DNSSEC setup will show:
- ✅ DS record in parent zone
- ✅ DNSKEY records in child zone
- ✅ RRSIG records with valid signatures
- ✅ Chain of trust up to root
How to Enable DNSSEC
Via Registrar (Most Common)
Most registrars provide one-click DNSSEC activation from the control panel. The registrar handles key generation, signing and DS record submission automatically.
With Cloudflare
If you use Cloudflare DNS, enable DNSSEC with one click from DNS → Settings → DNSSEC. Then add the DS record Cloudflare provides to your registrar.
Manually (BIND / PowerDNS)
# BIND — key generation dnssec-keygen -a ECDSAP256SHA256 -b 256 -n ZONE example.com dnssec-keygen -a ECDSAP256SHA256 -b 256 -n ZONE -f KSK example.com # Zone signing dnssec-signzone -A -3 $(head -c 1000 /dev/random | sha1sum | cut -b 1-16) \ -N INCREMENT -o example.com -t example.com.zone
Why You Need DNSSEC
| Threat | Without DNSSEC | With DNSSEC |
|---|---|---|
| DNS Cache Poisoning | ❌ Vulnerable | ✅ Impossible |
| BGP Hijacking (DNS) | ❌ Vulnerable | ✅ Detectable |
| Man-in-the-Middle DNS | ❌ Vulnerable | ✅ Protected |
| Typosquatting | ❌ Not covered | ❌ Not covered |