When DNS was designed, nobody expected attackers to forge its answers. In a cache poisoning attack, a resolver is tricked into storing a false answer, sending users to an attacker's server even though they typed the right address. DNSSEC adds cryptographic signatures to DNS so that forged answers can be detected and rejected.
How it works, in brief
- Your DNS zone is signed with a private key; each record set gets a signature.
- A record called DS, published at your domain's registry through your registrar, links your zone to the chain of trust above it.
- Validating resolvers check the signatures from the root of DNS down to your records. If anything does not match, the answer is rejected.
What it protects, and what it does not
DNSSEC proves that DNS answers are authentic and unmodified. It does not encrypt DNS queries, and it does not protect a domain whose registrar account has been taken over, because the attacker could change the records and signatures legitimately. Strong registrar security still matters.
Should you enable it?
For domains that matter to your business, especially banks, payment services, government and any service where redirecting users would be damaging, DNSSEC is a sensible additional layer. Many registries and DNS providers make it straightforward.
Doing it safely
- Make sure both your DNS host and your registrar support DNSSEC.
- Enable signing at your DNS host first, then publish the DS record at your registrar.
- Plan key rollovers, or use a provider that automates them.
- Be careful when changing DNS providers: remove or update the DS record in the right order, or the domain can become unreachable for validating resolvers.
- Monitor DNSSEC validation, so you hear about a broken signature before customers do.
How IDX helps
IDX includes DNS zone management with our hosting, and our team can advise on whether DNSSEC suits your domain and help you set it up and change providers safely.
IDX on digital infrastructure
Back to blog →