--- title: DNSSEC Explained: signing DNS so it can't be faked description: DNS was built without security — answers can be forged, sending users to fake servers. DNSSEC adds cryptographic signatures so resolvers can verify DNS answers are genuine. Here's how. canonical: https://watchfor.io/blog/dnssec-explained --- [All posts](/blog) [Security](/blog/category/security) Dec 04, 2025 · 3 min read · WatchFor Team # DNSSEC Explained: signing DNS so it can't be faked DNS was built without security — answers can be forged, sending users to fake servers. DNSSEC adds cryptographic signatures so resolvers can verify DNS answers are genuine. Here's how. [DNS](/blog/how-dns-works) is the internet's phonebook — and like an old phonebook, it was designed with no way to tell if an entry is genuine. That means a forged DNS answer can quietly send users to an attacker's server while the address bar still says your domain. DNSSEC is the fix: cryptographic signatures that prove DNS answers are real. ## The problem DNSSEC solves When your computer asks "what's the IP for example.com?", it trusts the answer it gets back. But that answer can be forged or tampered with in transit — an attack called DNS spoofing or cache poisoning . The result: you type the right name, get a wrong (malicious) IP, and land on a fake site — with no obvious sign anything's wrong. The core gap: classic DNS gives you an answer but no proof it's authentic. You can't tell a genuine response from a forged one. DNSSEC adds that proof. ## What DNSSEC does DNSSEC (DNS Security Extensions) adds digital signatures to DNS records. Each answer is cryptographically signed, and resolvers can verify the signature against a chain of trust — confirming the record genuinely came from the domain owner and wasn't altered. Without DNSSEC With DNSSEC Answers are unsigned Answers are cryptographically signed Forgery is possible Forged/tampered answers are detectable You trust blindly The resolver verifies If a signature doesn't validate, a DNSSEC-aware resolver rejects the answer rather than handing you a possibly-forged one. ## How the chain of trust works DNSSEC builds a chain from the [DNS root](/blog/how-dns-works) down to your domain: - The root zone is signed and trusted (its key is widely known). - The root vouches for the TLD ( .com ), which is signed. - The TLD vouches for your domain , which is signed. - A resolver follows this chain, verifying signatures at each step. It's a hierarchy of "this key vouches for that key," anchored at the root — so a forged answer anywhere in the chain fails to validate. ## What DNSSEC does and doesn't do It's important to be precise about its scope: DNSSEC does DNSSEC doesn't Prove DNS answers are authentic Encrypt DNS queries (that's DoH/DoT) Detect forged/tampered records Protect the website itself Prevent cache poisoning Replace [TLS/HTTPS](/blog/how-https-works) DNSSEC is about integrity (is this answer genuine?), not privacy (who can see my queries?). It complements, not replaces, HTTPS — you want both. ## Should you enable it? DNSSEC adds real protection against DNS forgery, but it has trade-offs: - ✅ Protects against cache poisoning / DNS spoofing. - ⚠️ Adds complexity — key management and signing, and a misconfiguration can make your domain fail to resolve entirely (a strict resolver rejects a bad signature). Many registrars and DNS providers now offer DNSSEC as a near one-click option, which removes most of the operational burden. If yours does, it's worth enabling — carefully. ## A monitoring note Because a DNSSEC misconfiguration can take your domain offline (signatures that don't validate get rejected), it's worth [monitoring DNS resolution](/blog/how-dns-works) — so a signing or key-rollover mistake shows up as an alert, not as users unable to reach you. ## The bottom line In one line What Cryptographic signatures that prove DNS answers are genuine. Stops DNS spoofing / cache poisoning (forged answers). Doesn't Encrypt queries or replace HTTPS — it's about integrity. Careful A misconfig can make your domain fail to resolve. DNSSEC plugs a foundational hole: it lets the internet verify DNS answers instead of trusting them blindly. Enable it where your provider makes it easy, keep HTTPS for the rest, and monitor resolution so a signing slip doesn't become an outage. Related: [How DNS works](/blog/how-dns-works), [DNS record types](/blog/dns-record-types-explained); inspect records with the free [DNS lookup](/dns-checker). [#security](/blog/tag/security)[#dns](/blog/tag/dns)[#networking](/blog/tag/networking) ## Monitor your DNS Watch resolution health and record changes from around the globe, and get alerted the moment something drifts. [Learn more](/dns-monitoring)[Start free](/auth/sign-up) Share this article --- Canonical page: https://watchfor.io/blog/dnssec-explained · Site guide: https://watchfor.io/llms.txt