---
title: DNSSEC Explained: signing DNS so it can't be faked
description: DNS was built without security — answers can be forged, sending users to fake servers. DNSSEC adds cryptographic signatures so resolvers can verify DNS answers are genuine. Here's how.
canonical: https://watchfor.io/blog/dnssec-explained
---

# DNSSEC Explained: signing DNS so it can't be faked

2025-12-04 · WatchFor Team · Security · security, dns, networking

DNS was built without security — answers can be forged, sending users to fake servers. DNSSEC adds cryptographic signatures so resolvers can verify DNS answers are genuine. Here's how.

[DNS](/blog/how-dns-works) is the internet's phonebook — and like an old phonebook, it was designed with no way to tell if an entry is genuine. That means a forged DNS answer can quietly send users to an attacker's server while the address bar still says your domain. **DNSSEC** is the fix: cryptographic signatures that prove DNS answers are real.

## The problem DNSSEC solves

When your computer asks "what's the IP for example.com?", it trusts the answer it gets back. But that answer can be **forged** or **tampered with** in transit — an attack called **DNS spoofing** or **cache poisoning**. The result: you type the right name, get a *wrong* (malicious) IP, and land on a fake site — with no obvious sign anything's wrong.

> **The core gap:** classic DNS gives you an answer but **no proof it's authentic.** You can't tell a genuine response from a forged one. DNSSEC adds that proof.

## What DNSSEC does

**DNSSEC (DNS Security Extensions)** adds **digital signatures** to DNS records. Each answer is cryptographically signed, and resolvers can verify the signature against a chain of trust — confirming the record genuinely came from the domain owner and wasn't altered.

| Without DNSSEC | With DNSSEC |
| --- | --- |
| Answers are unsigned | Answers are cryptographically signed |
| Forgery is possible | Forged/tampered answers are detectable |
| You trust blindly | The resolver *verifies* |

If a signature doesn't validate, a DNSSEC-aware resolver **rejects** the answer rather than handing you a possibly-forged one.

## How the chain of trust works

DNSSEC builds a chain from the [DNS root](/blog/how-dns-works) down to your domain:

1. The **root** zone is signed and trusted (its key is widely known).
2. The root vouches for the **TLD** (`.com`), which is signed.
3. The TLD vouches for **your domain**, which is signed.
4. A resolver follows this chain, verifying signatures at each step.

It's a hierarchy of "this key vouches for that key," anchored at the root — so a forged answer anywhere in the chain fails to validate.

## What DNSSEC does and doesn't do

It's important to be precise about its scope:

| DNSSEC **does** | DNSSEC **doesn't** |
| --- | --- |
| Prove DNS answers are authentic | Encrypt DNS queries (that's DoH/DoT) |
| Detect forged/tampered records | Protect the website itself |
| Prevent cache poisoning | Replace [TLS/HTTPS](/blog/how-https-works) |

DNSSEC is about **integrity** (is this answer genuine?), not **privacy** (who can see my queries?). It complements, not replaces, HTTPS — you want both.

## Should you enable it?

DNSSEC adds real protection against DNS forgery, but it has trade-offs:

- ✅ **Protects against cache poisoning / DNS spoofing.**
- ⚠️ **Adds complexity** — key management and signing, and a misconfiguration can make your domain *fail to resolve* entirely (a strict resolver rejects a bad signature).

Many registrars and DNS providers now offer DNSSEC as a near one-click option, which removes most of the operational burden. If yours does, it's worth enabling — carefully.

## A monitoring note

Because a DNSSEC *misconfiguration* can take your domain offline (signatures that don't validate get rejected), it's worth [monitoring DNS resolution](/blog/how-dns-works) — so a signing or key-rollover mistake shows up as an alert, not as users unable to reach you.

## The bottom line

| | In one line |
| --- | --- |
| **What** | Cryptographic signatures that prove DNS answers are genuine. |
| **Stops** | DNS spoofing / cache poisoning (forged answers). |
| **Doesn't** | Encrypt queries or replace HTTPS — it's about integrity. |
| **Careful** | A misconfig can make your domain fail to resolve. |

DNSSEC plugs a foundational hole: it lets the internet *verify* DNS answers instead of trusting them blindly. Enable it where your provider makes it easy, keep HTTPS for the rest, and monitor resolution so a signing slip doesn't become an outage.

Related: [How DNS works](/blog/how-dns-works), [DNS record types](/blog/dns-record-types-explained); inspect records with the free [DNS lookup](/dns-checker).

---

Canonical page: https://watchfor.io/blog/dnssec-explained · All articles: https://watchfor.io/blog/all.md · Site guide: https://watchfor.io/llms.txt