DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records so answers can't be forged in transit.
DNSSEC is a security layer for DNS. Plain DNS was designed in the 1980s without any way to check that an answer is genuine. DNSSEC fixes that by signing your DNS records with a digital key, so a resolver can confirm the answer really came from your domain's nameservers and wasn't changed along the way.
Without it, an attacker who can tamper with DNS responses could send visitors to a fake copy of your site or reroute your email. This kind of attack is called DNS spoofing or cache poisoning.
How DNSSEC works
DNSSEC builds a chain of trust from the top of DNS down to your domain:
- Your DNS provider signs each set of records in your zone file with a private key, creating RRSIG records.
- It publishes the matching public key in a DNSKEY record.
- A fingerprint of that key, called a DS record, is added at your registrar, which passes it to the registry for your TLD.
- The TLD is signed by the root, and the root's key is built into validating resolvers.
When a validating resolver looks up your domain, it checks each signature up the chain. If anything doesn't match, it refuses the answer rather than giving out a possibly fake one.
Why DNSSEC matters
- Stops forged DNS answers, protecting visitors from being sent to imposter sites.
- Protects email routing, since MX records are signed too.
- Supports newer security standards like DANE, which rely on signed DNS.
It's especially worth turning on for banks, shops, government sites and anyone who handles logins or payments.
DNSSEC vs SSL certificates
They protect different things. An SSL certificate encrypts the connection between a browser and your server and proves the server's identity. DNSSEC proves the DNS answer pointing to that server is genuine. It doesn't encrypt anything. Used together, they give a stronger defence.
Common DNSSEC problems
DNSSEC's biggest risk is misconfiguration, which can make your whole domain unreachable for anyone using a validating resolver.
- Changing DNS hosts without updating DS records: the new provider's keys don't match the DS record at the registry. Remove DNSSEC before moving nameservers, then set it up again afterwards.
- Expired signatures: signatures have an expiry date and must be refreshed, which managed DNS providers do automatically.
- Key rollover mistakes: swapping keys in the wrong order breaks the chain.
- Unsupported TLDs: not every extension supports DNSSEC.
At AblePage, support can switch DNSSEC on for domains whose TLD supports it.