What is DNSSEC?

DNSSEC (Domain Name System Security Extensions) is a set of protocols that add cryptographic signatures to DNS records. Those signatures let a resolver verify that the answer it received is authentic and hasn't been altered in transit.

Plain DNS has no way to prove where an answer came from. A resolver asks a question and trusts whatever comes back, which is what makes cache poisoning possible: convince a resolver to store a forged answer and every user behind it is quietly sent somewhere else, with a correct-looking address bar. DNSSEC closes that by making forgery detectable.

The chain of trust

DNSSEC works by signing, not by encrypting — the data stays public, but it becomes verifiable. Each signed zone publishes a public key (a DNSKEY record) and a signature over each record set (an RRSIG). A resolver checks the signature against the key.

That only moves the question: how do you trust the key? By having the level above vouch for it. The parent zone publishes a DS record — a hash of the child's key — and signs it with its own. So .best vouches for example.best, the root vouches for .best, and the root's key is the one thing a resolver is configured to trust outright. Follow the links and any signed name resolves back to a single anchor.

Break a link and validation fails closed: a resolver that cannot verify an answer returns an error rather than a guess. That is the intended behaviour, and it is also why a mismatched DS record after a nameserver change takes a domain offline for validating users while it still works for everyone else — one of the more confusing failure modes in DNS.

What DNSSEC does and doesn't do

• Does prove that a DNS answer came from the zone's operator and reached you unmodified.
• Does prove that a name does not exist, through authenticated denial — so an attacker cannot suppress a record by claiming it is missing.
• Does not encrypt anything. DNS queries stay visible on the wire; that is the job of DNS over TLS or HTTPS.
• Does not vouch for the site at the other end. A validated answer means the address is genuine, not that its owner is.
• Does not help unless the resolver validates. Most large public resolvers do; some networks still don't.

Who signs what

The registry signs the TLD zone and publishes the DS records that vouch for individual domains. The registrant, usually through their DNS provider, signs their own zone and passes the DS record to the registry via their registrar over EPP. Most providers now automate both halves, which is why enabling DNSSEC is often a single switch.

The .best zone is DNSSEC-signed, so a name in the namespace can be validated end to end — root to TLD to domain — by any resolver that checks.