What Is DNSSEC, and What Does It Actually Protect Against?
DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS responses, so a validating resolver can detect whether an answer was tampered with in transit — for example by a DNS cache-poisoning or spoofing attack. It does not encrypt DNS traffic and does not protect against every DNS-based attack; it protects the integrity and authenticity of the answers themselves.
Last updated August 9, 2026.
How the chain works, briefly
Your DNS host signs your zone with a key pair. The public half is published as a DNSKEY record. A hash of that key — the DS (Delegation Signer) record — is then published at your domain's parent zone (by your registrar), linking your zone's signature into the parent's. This chain continues up to the root, which is why it's called a chain of trust.
A validating resolver walks that chain from the root down. If every link verifies, it returns the answer with the authenticated-data (AD) flag set. If any link fails to verify — a mismatched DS after a key rotation is the most common cause — the resolver returns SERVFAIL rather than a possibly-forged answer, which is why a botched DNSSEC rotation can take a domain offline for everyone behind a validating resolver while it still loads fine elsewhere.
What Nivaronix checks — and what it doesn't
Nivaronix checks whether DNSSEC is enabled — specifically, whether a DS record is published at the parent zone, and whether our resolver's response carried the authenticated-data (AD) flag for that lookup. This is a presence-and-signature-status check, not full chain-of-trust validation from the root down through every intermediate zone. For an independent, full-chain validation view, use a dedicated tool such as dnsviz.net.
Enabling it, and the one rule that matters
- Turn on DNSSEC signing at your DNS host.
- Take the DS record it generates and add it to your domain at your registrar (the party that controls the parent zone delegation).
- Wait for propagation before relying on it, and re-check with a full-chain tool.
- Never remove or rotate a key without first disabling signing in the correct order — an out-of-sync DS record is the single most common cause of a DNSSEC-signed domain going dark.