The DNS (Domain Name System) is the internet’s address book: it translates easy-to-remember domain names (such as pelda.hu) into the IP addresses used by computers, and also specifies which server handles the domain’s emails. DNSSEC (Domain Name System Security Extensions) is not a separate system, but an extension of the DNS: it uses digital signatures to verify that the response received actually originates from the domain’s zone and has not been altered en route.

How does traditional DNS work?

When you enter a web address into your browser, your computer queries a DNS resolver (this is usually your internet service provider’s or a public resolver). The resolver queries the hierarchy starting from the root zone: it finds out from the TLD’s name servers which name server is responsible for the domain, and then retrieves the requested record – for example, the A record – from there. It stores the responses in its cache for a certain period (until the TTL expires).

In traditional DNS, the resolver has no way of verifying whether the response is authentic. Cache poisoning exploits this: the attacker injects a fake response into the resolver, which then redirects users to another server – which may even be a phishing server.

What does DNSSEC add?

When DNSSEC is enabled, the domain’s zone is signed. A signature (RRSIG) is added to the records, the zone publishes its public keys (DNSKEY), and a DS record in the TLD zone specifies which key belongs to the domain. This creates a chain of trust from the root zone to the domain, and the resolver performing the verification can check every step. The process is explained step by step in the article ‘How does DNSSEC authentication work?’.

The differences in a table

	DNS	DNSSEC
Responsibilities	Resolving domain names to IP addresses and other data	Verifying the authenticity of DNS responses
Records	A, AAAA, MX, CNAME, TXT, NS and others	In addition to the above: DNSKEY, RRSIG, DS, NSEC/NSEC3
In the event of a false response	The redeemer accepts	The verification code is rejected
Settings	in the DNS zone	Signing the zone and adding the DS record to the registry
Maintenance	only when records change	Continuous renewal of certificates, key rotation

What does DNSSEC not protect against?

• It does not encrypt. DNSSEC verifies the authenticity of responses, but queries remain readable. DNS over TLS (DoT) and DNS over HTTPS (DoH) are used to encrypt queries.
• It does not protect against your account being hacked. If someone gains access to domain management or the DNS zone, the system will authenticate even fraudulent records. You can protect against this by using a strong password, two-factor authentication and locking your domain.
• It is not a substitute for an SSL certificate. DNSSEC protects the resolution of domain names, whilst traffic between the website and the visitor continues to be encrypted by HTTPS.

Do I need both?

A domain cannot function without DNS, but DNSSEC is not mandatory. If you enable it, resolvers querying or verifying the domain name will only accept authentic responses. The downside is that an incorrect configuration (for example, an out-of-date DS record following a name server change) may cause the domain to become inaccessible. It is therefore advisable to enable DNSSEC where the zone and the DS record are managed by the same provider, or where changes are carefully monitored by someone.