Skip to content

What Is DNSSEC, and What Does It Actually Protect Against?

DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS responses, so a validating resolver can detect whether an answer was tampered with in transit — for example by a DNS cache-poisoning or spoofing attack. It does not encrypt DNS traffic and does not protect against every DNS-based attack; it protects the integrity and authenticity of the answers themselves.

Last updated August 9, 2026.

How the chain works, briefly

Your DNS host signs your zone with a key pair. The public half is published as a DNSKEY record. A hash of that key — the DS (Delegation Signer) record — is then published at your domain's parent zone (by your registrar), linking your zone's signature into the parent's. This chain continues up to the root, which is why it's called a chain of trust.

A validating resolver walks that chain from the root down. If every link verifies, it returns the answer with the authenticated-data (AD) flag set. If any link fails to verify — a mismatched DS after a key rotation is the most common cause — the resolver returns SERVFAIL rather than a possibly-forged answer, which is why a botched DNSSEC rotation can take a domain offline for everyone behind a validating resolver while it still loads fine elsewhere.

What Nivaronix checks — and what it doesn't

Nivaronix checks whether DNSSEC is enabled — specifically, whether a DS record is published at the parent zone, and whether our resolver's response carried the authenticated-data (AD) flag for that lookup. This is a presence-and-signature-status check, not full chain-of-trust validation from the root down through every intermediate zone. For an independent, full-chain validation view, use a dedicated tool such as dnsviz.net.

Enabling it, and the one rule that matters

  1. Turn on DNSSEC signing at your DNS host.
  2. Take the DS record it generates and add it to your domain at your registrar (the party that controls the parent zone delegation).
  3. Wait for propagation before relying on it, and re-check with a full-chain tool.
  4. Never remove or rotate a key without first disabling signing in the correct order — an out-of-sync DS record is the single most common cause of a DNSSEC-signed domain going dark.

FAQ

What is DNSSEC?

DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS responses so a validating resolver can verify an answer came from the real authoritative source and wasn't altered in transit. It protects the integrity and authenticity of DNS answers — it does not encrypt DNS traffic.

How does DNSSEC work?

Your DNS host signs your zone and publishes the public key as a DNSKEY record. A hash of that key — the DS record — is published at the parent zone by your registrar, chaining your zone's signature up to the root. A validating resolver walks that chain from the root down; if every link verifies, the answer is trusted.

What does "DNSSEC: unsigned" mean?

It means the domain has no DS record published at its parent zone, so there's no chain of trust to validate — the domain simply isn't using DNSSEC. This is the default state for most domains, not an error.

How do I check if DNSSEC is enabled for a domain?

Look up the domain's DS record at its parent zone. If one exists, check that it matches the DNSKEY the domain currently publishes — a mismatch (usually from a botched key rotation) means the domain is signed but failing to resolve for validating resolvers. Nivaronix's DNSSEC checker does this lookup for you.

Can DNSSEC take a domain offline?

Yes — a mismatched DS record after a key rotation causes validating resolvers to return SERVFAIL instead of a possibly-forged answer. The domain will appear to work fine on networks that skip validation while failing everywhere else, which makes the cause easy to miss.

Related

Check your DNSSEC status now

Scan your domain free