Cache poisoning, signatures, chain of trust, DS record: what DNSSEC protects, where its limits are and how to enable it without making your domain unreachable.
By Mouhamed BANKOLE, CEO at ITNET Technologies · Updated October 22, 2026 · Reading time: 9 min
When a visitor types your website address, their computer queries a chain of DNS servers they never see. If one of those servers stores a forged answer, the visitor can land on a booby-trapped copy of your site, and nothing in the address bar warns them. DNSSEC was designed to close that door. This guide explains what DNSSEC protects against, how its signatures work, what it does not do, and how to enable it on your domain name without making your DNS zone unreachable.
In short
- DNSSEC is a security extension to DNS that signs DNS answers to prove they really come from the zone operator and have not been tampered with.
- It protects against cache poisoning and spoofed DNS answers, which send visitors to a fake server.
- It encrypts nothing: it guarantees that answers are authentic, not that they are private, and it replaces neither HTTPS nor the security of your account.
- Turning it on takes two moves: sign the zone at your DNS host, then publish the DS record at the registry through your registrar.
- The main risk is a key mismatch: a DS record that no longer matches the zone makes the domain unreachable for validating resolvers.
Contents
- What is DNSSEC?
- Which attacks does DNSSEC protect against?
- How does DNSSEC work: signatures and the chain of trust?
- Which DNS records does DNSSEC add to your zone?
- What does DNSSEC not protect?
- How do you enable DNSSEC on a domain name?
- How do you check that DNSSEC is working?
- Which mistakes make a domain unreachable with DNSSEC?
- Should you enable DNSSEC on all your domains?
What is DNSSEC?
DNSSEC (Domain Name System Security Extensions) is a set of extensions that adds cryptographic signatures to DNS answers, so that a resolver can check that an answer is authentic and unaltered. It is specified by the IETF in RFC 4033, alongside RFC 4034 and 4035.
To put DNSSEC in context, here is what DNS does:
- DNS translates a domain name (yoursite.com) into a server IP address;
- every domain has a DNS zone, the set of its records (A, MX, CNAME, TXT…);
- originally, the protocol offered no way to prove that an answer really came from the right server.
DNSSEC fills that gap without changing how DNS works: records stay the same, they simply come with signatures. ICANN describes DNSSEC as the way to make sure users reach the website or service they actually asked for.
Which attacks does DNSSEC protect against?
DNSSEC mainly protects against DNS cache poisoning and against any DNS answer forged in transit, two attacks that divert visitors to a server controlled by the attacker.
The main scenarios it covers:
- cache poisoning: the attacker injects a fake answer into a resolver's cache, which then serves it to all its users;
- response spoofing: a forged answer arrives before the real one and the resolver accepts it;
- on-path tampering: a device in the middle rewrites DNS answers, on a public Wi-Fi network for instance;
- mail hijacking: a fake MX record can route your incoming email to another server.
The risk is not theoretical: the cache poisoning flaw disclosed in 2008 and tracked as CVE-2008-1447 by ISC affected most DNS software of the time and gave DNSSEC deployment a new push.
Pro tip: DNSSEC protects the answer, not the account that manages the domain. Also turn on two-factor authentication at your registrar and the transfer lock: an attacker who takes over your account can edit the zone, and DNSSEC will then sign their changes.
How does DNSSEC work: signatures and the chain of trust?
DNSSEC relies on key pairs: the zone operator signs its records with a private key, and resolvers check those signatures with the public key published in the zone. Trust in that public key is in turn vouched for by the parent zone.
The process works like this:
- the DNS operator signs each set of records in the zone;
- it publishes the zone's public key in a DNSKEY record;
- a fingerprint of that key (the DS record) is placed in the parent zone, for example the .com registry;
- the parent zone is signed in turn, all the way up to the DNS root;
- the resolver starts from the root key, which it already knows, and checks every link down to your domain.
This chain of trust is what makes DNSSEC robust: forging an answer would mean breaking a signature at every level. The DNS root has been signed since July 2010, according to the launch history published by IANA, which made the end-to-end chain possible. Cloudflare explains the same principle with step-by-step diagrams.
Which DNS records does DNSSEC add to your zone?
DNSSEC adds four types of DNS records to your zone (DNSKEY, RRSIG, NSEC or NSEC3) and a DS record at the registry. Your usual records do not change.
| Record | Where it lives | What it does |
|---|---|---|
| DNSKEY | Your zone | Publishes the zone's public keys |
| RRSIG | Your zone | Holds the signature of each record set |
| NSEC / NSEC3 | Your zone | Proves that a name does not exist (signed negative answer) |
| DS | Parent zone (registry) | Fingerprint of your key, linking your zone to the chain of trust |
| A, MX, CNAME, TXT | Your zone | Unchanged, but now signed |
In practice there are two keys:
- the KSK (Key Signing Key), which signs the keys and whose fingerprint goes to the registry;
- the ZSK (Zone Signing Key), which signs the records and can be rotated without touching the registry.
With a DNS host that manages DNSSEC for you, these keys are created, used and rotated automatically.
What does DNSSEC not protect?
DNSSEC does not encrypt DNS queries and protects neither your website content, nor your account, nor the traffic between the browser and the server. It only guarantees that the DNS answer is authentic.
What stays outside its scope:
- privacy: queries remain readable; that is the job of other protocols such as DNS over HTTPS;
- website encryption: HTTPS and its certificate are still essential;
- account takeover: fraudulent access to your registrar account lets someone edit a zone that will be signed legitimately;
- denial-of-service attacks against your DNS servers;
- non-validating resolvers: a user whose resolver ignores DNSSEC gets no verification.
The DNS best practices guide from ANSSI, the French cybersecurity agency, recommends combining DNSSEC with a secured registrar account and monitoring of zone changes.
How do you enable DNSSEC on a domain name?
To enable DNSSEC, you sign the zone at your DNS host, then publish the matching DS record at the extension's registry through your registrar. When both are with the same provider, it often comes down to a single button.
The steps:
- check that your extension supports DNSSEC (.com, .fr and most common extensions do);
- turn on zone signing in your DNS host's dashboard;
- retrieve the DS record (or DNSKEY) it generates;
- submit it to your registrar, which passes it on to the registry;
- wait until the new configuration is visible, then test the full chain.
At Wayhost, the Wayhost domain name page lists "DNSSEC security included", full DNS management of A, MX, CNAME and TXT records, and a transfer lock (observed on October 22, 2026 on the domain name page).
If your domain is registered elsewhere and you want to keep the domain and its DNS in one place, a domain transfer lets you move it without service interruption. Be careful in that case: disable or carry over DNSSEC cleanly while you change DNS host (see the section on mistakes).
How do you check that DNSSEC is working?
To check DNSSEC, query your domain with a chain-of-trust testing tool or with the dig command, and confirm that the answer is flagged as authenticated. A visual test is the easiest place to start.
Three complementary methods:
- an online analyser such as DNSViz, which draws the chain from the root down to your domain and flags every broken link;
- the command
dig +dnssec yoursite.com: RRSIG records and thead(authenticated data) flag from a validating resolver confirm the signature; - a consistency check: compare the DS record published at the registry with your zone's DNSKEY.
Run this check again after every change of DNS host, name servers or key.
Which mistakes make a domain unreachable with DNSSEC?
The most serious mistake is a DS record at the registry that no longer matches the zone's keys: validating resolvers then treat every answer as forged and the domain becomes unreachable. The website, email and every other service on the domain go down at once.
Risky situations:
- changing DNS host without removing the old DS or publishing the new one;
- expired signatures: a manually signed zone whose signatures nobody renews;
- rotating the KSK without updating the DS at the registry;
- transferring the domain to a provider that does not carry over the DNSSEC setup;
- editing the zone by hand on an unsigned secondary server.
Pro tip: before changing DNS host, remove the DS record, wait for its cache lifetime to expire, migrate the zone, then re-enable DNSSEC at the new host. This sequence avoids any outage.
This matters even more for agencies that manage many client domains: our domain name guide explains how to register, renew and keep each domain under control.
Should you enable DNSSEC on all your domains?
Yes: as soon as your DNS host handles signing and key rotation automatically, DNSSEC is worth enabling on all your domains, including those used only for email. The risk of error mostly comes from manual setups.
Domains to secure first:
- your main domain, for your website and online shop;
- your email domain, whose MX, SPF and DKIM records steer your mail; with a professional email address on your domain, a signed zone also protects how your messages are routed, as our professional email guide explains in more detail;
- API and application domains, often called by machines that never look at what a page looks like;
- redirect domains that protect your brand.
On the other hand, if you run your own DNS server without automation, write down a key rotation procedure before enabling DNSSEC.
Frequently asked questions
What is DNSSEC in a nutshell?
DNSSEC is a security extension to DNS that adds digital signatures to DNS answers. It lets resolvers check that an answer really comes from the domain operator and has not been altered. It therefore protects visitors from being redirected to fake servers.
Does DNSSEC encrypt DNS queries?
No, DNSSEC authenticates answers but does not encrypt them. Queries remain readable by intermediaries on the network. Encryption is handled by other protocols such as DNS over HTTPS or DNS over TLS.
Does DNSSEC slow down my website?
The effect is negligible for visitors, because signed answers are cached like any others. DNS answers are slightly larger because of the signatures. Page load time is not noticeably affected.
Do you need a DS record to enable DNSSEC?
Yes, the DS record published at the registry links your signed zone to the chain of trust. Without it, the zone is signed but no resolver can validate it. You submit it through the domain's registrar.
What happens if DNSSEC is misconfigured?
If the DS record no longer matches the zone's keys, validating resolvers reject the answers. The domain then becomes unreachable for a large share of users, website and email included. You need to fix or remove the DS record to restore access.
Can you transfer a domain that uses DNSSEC?
Yes, but you need to plan the switch to avoid an outage. The safest approach is to remove the DS record, wait for the cache to expire, transfer the domain and then re-enable DNSSEC at the new provider. Some providers can also take over the existing keys.
Does DNSSEC protect against phishing?
It protects against one specific kind of phishing, the kind that hijacks DNS answers for your own domain. It does not protect against a lookalike domain with a typo in it. For that, register the close variants of your name.
How can you tell whether a domain uses DNSSEC?
Test the domain with an online analyser such as DNSViz, or with the dig command and its dnssec option. The tool shows whether signatures and a DS record exist. It also flags every broken link in the chain.
Key takeaways
- DNSSEC signs DNS answers to prove where they come from and that they are intact.
- It blocks cache poisoning and spoofed answers, without encrypting queries.
- Enabling it takes two steps: sign the zone, then publish the DS record at the registry.
- The only real mistake to fear is a DS record that no longer matches the keys, especially when changing host.
- A DNS host that automates keys makes DNSSEC easy to enable on all your domains.
To secure your domain with DNSSEC included and full DNS management, explore the Wayhost domain name offer.
Article written by Mouhamed BANKOLE, CEO at ITNET Technologies.