DNSSEC in Plain English (and Whether You Need It)
· DNS · Security
Quick answer
What is DNSSEC, and do I need to enable it?
DNSSEC adds cryptographic signatures to DNS records so a resolver can verify that an answer was not forged or altered in transit. It does not encrypt DNS traffic and it does not hide your browsing — that is a different set of protocols. Whether to enable it depends on whether your registrar and DNS provider support it and whether you can manage key rollovers safely.
The problem it solves
A normal DNS answer is easy to forge if an attacker can intercept or poison the lookup. DNSSEC lets the zone owner sign its records; a validating resolver checks the signature chain from the root down to the zone before trusting the answer. If the signature does not check out, the lookup fails instead of returning a tampered address.
What it does not do
This is the part most summaries get wrong. DNSSEC provides authenticity, not confidentiality.
- It does not encrypt queries — DNS-over-HTTPS and DNS-over-TLS do that.
- It does not hide the names you look up from your resolver.
- It does not secure your website, your email content or your registrar account.
- It does not protect against a compromised registrar account changing the zone legitimately.
Should you turn it on?
If your registrar and authoritative DNS provider both support DNSSEC and offer managed signing, enabling it is a reasonable integrity upgrade with little day-to-day work. If you would have to manage keys, DS records and rollovers manually, a mistake can make the entire domain unresolvable — a much bigger availability risk than the attack it prevents. Check the support documentation on both sides first.
Frequently asked questions
Is DNSSEC the same as DNS over HTTPS?
No. DNSSEC signs records so answers can be authenticated; DNS over HTTPS encrypts the transport of the query. They solve different problems and can be used together.
Can DNSSEC take my site offline?
A broken signature chain or a mismatched DS record at the registrar can cause validating resolvers to reject all lookups for the zone. That is why managed signing and a documented rollback path matter.
Does TLD List show DNSSEC status for each TLD?
The catalogue is built from IANA delegation data and registrar prices. It does not audit per-domain DNS configuration, so check your own authoritative DNS provider for DNSSEC status.
Sources
Primary sources for the claims above.