GlossarySecurity and reputation
DNSSEC
Definition
DNSSEC adds a cryptographic signature to a DNS zone's answers. A resolver that verifies it can state that the answer really came from the zone's manager and was not altered in transit. Trust climbs from the zone up to the root, one link at a time.
What it protects, and where it breaks
DNS was designed without proof of origin: a forged answer injected at the right moment sends visitors elsewhere, to a site that can look identical to the real one. DNSSEC closes that door. It encrypts nothing and hides nothing — it authenticates, which is a different job.
You turn it on in two places, and that is where all the risk sits. The DNS host signs the zone; the registrar publishes the digest of the key at the registry, the DS record, which hooks the zone into the chain. If the two fall out of step — a key rotated on one side and not the other — the domain does not become “less secure”: it goes flatly unreachable for every resolver that validates.
The digest published at the registry
The DS record: the link that ties the domain's zone into the chain of trust.
example.com. 86400 IN DS 12345 13 2 49FD46E6C4B45C55D4AC7A1E8B3F...It does not live in the domain's own zone but in the extension's, one level up. That is why you add it at the registrar rather than at the DNS host, and why removing DNSSEC takes two operations in the right order.
The usual mistake
Changing DNS host on a signed domain without turning DNSSEC off first. The new zone is served with keys that do not match the digest announced at the registry: validating resolvers refuse every answer, and the domain disappears entirely for part of the internet.
How to avoid it: On a signed domain, remove the DS record at the registrar, wait for its TTL to elapse, migrate, then sign again. A domain with broken DNSSEC does not degrade gently: it goes dark.
Source: DNSSEC is defined in RFC 4033, 4034 and 4035, which describe the chain of trust, the key records and the signatures.
Related terms
Where to go next
Knowing the words is half the job
The other half is knowing which of your domains is about to become a problem. DomainVigil watches expiry, DNS, certificates and reputation, and tells you before your client does.
Start for freeFive domains free, forever. No card required.