DNSSEC (DNS security)

DNSSEC (Domain Name System Security Extensions) is a security layer added on top of ordinary DNS. DNS itself works like the internet's phone book - it turns a domain name into an IP address - but in its basic form it never checks whether the answer is genuine. If you are asking what DNSSEC is, it is exactly the mechanism that attaches a digital signature to a DNS answer and lets you verify it.

Without DNSSEC an attack called DNS spoofing or cache poisoning is possible: an attacker slips in a forged answer and sends users to a fake site - identical to the real one, but built to steal passwords. It is like swapping a number in the phone book: you call "your bank" but reach a scammer. DNSSEC prevents this because every answer is cryptographically signed and forms an unbroken chain of trust up to the internet's root servers.

In practice, enabling DNSSEC means generating keys that sign your zone and publishing a DS record at your domain registrar (the company you bought the domain from). It is a technical setting, but worth the effort - especially for banks, stores, and anywhere trust in the domain is critical. Note: DNSSEC guarantees the authenticity of DNS answers, but it does not encrypt traffic - that is what HTTPS is for.

You can check whether your domain has DNSSEC correctly enabled and a DS record published with our free DNS Lookup tool at /dns.