DNSSEC Explained: What It Fixes, What It Does Not, and Why So Few Use It

Plain DNSIn plain words: The internet’s phone book. You type an easy name like stashgrid.ai, and DNS looks up the number address that computers really use, the way a street address tells the mail carrier where to go.Technical: Domain Name System. A worldwide set of servers that turns names into IP addresses. Your device asks a DNS server (usually your router or your provider) every time you visit a site.Click for the full glossary entry answers are not signed. Your computer asks “what is the address for this name?” and believes whatever comes back first. If an attacker can slip in a forged answer, your computer goes to the attacker’s address instead of the real one, and nothing looks wrong.

This is called DNS spoofing or cache poisoning. A famous 2008 discovery by researcher Dan Kaminsky showed it was far easier than people had assumed, and gave DNSSECIn plain words: A tamper-proof seal on DNS answers. It lets your computer check that a website’s address answer was not faked on the way. It does not hide or encrypt anything.Technical: DNS Security Extensions. Adds digital signatures (RRSIG, DNSKEY, DS records) forming a chain of trust from the root zone down. A validating resolver rejects answers whose signatures do not check out.Click for the full glossary entry a lot of urgency.

The attacker’s view. A forged DNS answer can send you to a fake bank site that even has the right name in the address bar. That is much more convincing than a lookalike domainIn plain words: The easy-to-read name of a website or email sender, like example.com. In an email from sam@example.com, the domain is the part after the @.Technical: A name registered in the global naming system, made of labels separated by dots, and resolved to addresses by DNS.Click for the full glossary entry.

DNSSECIn plain words: A tamper-proof seal on DNS answers. It lets your computer check that a website’s address answer was not faked on the way. It does not hide or encrypt anything.Technical: DNS Security Extensions. Adds digital signatures (RRSIG, DNSKEY, DS records) forming a chain of trust from the root zone down. A validating resolver rejects answers whose signatures do not check out.Click for the full glossary entry adds digital signatures to DNSIn plain words: The internet’s phone book. You type an easy name like stashgrid.ai, and DNS looks up the number address that computers really use, the way a street address tells the mail carrier where to go.Technical: Domain Name System. A worldwide set of servers that turns names into IP addresses. Your device asks a DNS server (usually your router or your provider) every time you visit a site.Click for the full glossary entry answers. Think of a tamper-proof seal on an envelope: you cannot tell what is inside from the seal, but you can tell whether someone opened and changed it.

• The domainIn plain words: The easy-to-read name of a website or email sender, like example.com. In an email from sam@example.com, the domain is the part after the @.Technical: A name registered in the global naming system, made of labels separated by dots, and resolved to addresses by DNS.Click for the full glossary entry owner signs their records with a privateIn plain words: An address used inside your home or office only, like an apartment number: many buildings reuse the same ones.Technical: Reserved ranges: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Not routable across the internet.Click for the full glossary entry key. The matching public key is published in DNS (a DNSKEY record) and each answer gets a signature (an RRSIG record).
• The parent zone (for example .com) publishes a fingerprint of the child’s key (a DS record), and the root zone does the same for .com, and so on. This is the chain of trust: each link vouches for the one below it, ending at a root key that validating software already knows.
• A validating resolverIn plain words: The helper that looks up names for you, like a receptionist who knows who to ask. Your router or internet provider normally runs it.Technical: A server that answers DNS questions for clients, asking other DNS servers if it does not already know and remembering answers for a while (caching).Click for the full glossary entry checks the chain. If any signature does not match, it returns an error instead of the answer.

It is defined in RFC 4033 (overview and requirements), RFC 4034 (resource records) and RFC 4035 (protocol modifications), and RFC 9364 (a 2023 summary, BCP 237) says those are the core documents.

What it proves. That the answer really came from the domain’s owner (authenticity) and was not changed on the way (integrity). Also, it can prove a name does not exist.

This list is the part most people miss.

• It does not encrypt anything. Anyone on the path can still see which names you look up. That is the job of DNSIn plain words: The internet’s phone book. You type an easy name like stashgrid.ai, and DNS looks up the number address that computers really use, the way a street address tells the mail carrier where to go.Technical: Domain Name System. A worldwide set of servers that turns names into IP addresses. Your device asks a DNS server (usually your router or your provider) every time you visit a site.Click for the full glossary entry over HTTPS or TLS.
• It does not protect the last step from your computer to your resolverIn plain words: The helper that looks up names for you, like a receptionist who knows who to ask. Your router or internet provider normally runs it.Technical: A server that answers DNS questions for clients, asking other DNS servers if it does not already know and remembering answers for a while (caching).Click for the full glossary entry unless your own device validates. Most home computers trust the resolver to do it.
• It does not protect the website. It proves you got the right address. It does not prove the site at that address is honest. HTTPS and certificates cover that step.
• It does not stop phishingIn plain words: A fake email, text or website that pretends to be someone you trust, like your bank, to trick you into giving up a password or money.Technical: Social engineering by message. Typical signs are urgency, a mismatched sender domain, a link that does not go where it says, and a request for credentials or payment.Click for the full glossary entry. A fake domainIn plain words: The easy-to-read name of a website or email sender, like example.com. In an email from sam@example.com, the domain is the part after the @.Technical: A name registered in the global naming system, made of labels separated by dots, and resolved to addresses by DNS.Click for the full glossary entry can be perfectly signed. A scammer can sign paypa1.com just as correctly as PayPal signs its own.
• It does not help if the account is hacked. If an attacker takes over the domain at the registrarIn plain words: The shop a website name was bought from.Technical: An accredited company that registers domain names for customers, such as GoDaddy or Namecheap. It is not necessarily where the website is hosted.Click for the full glossary entry, the new records get signed by the attacker.
• It only works if the domain is signed. An unsigned domain gets no protection, and a validating resolver has no way to tell “unsigned” from “stripped.” (There is a rule that closes that gap, but only for signed domains.)

Why this matters. “DNSSECIn plain words: A tamper-proof seal on DNS answers. It lets your computer check that a website’s address answer was not faked on the way. It does not hide or encrypt anything.Technical: DNS Security Extensions. Adds digital signatures (RRSIG, DNSKEY, DS records) forming a chain of trust from the root zone down. A validating resolver rejects answers whose signatures do not check out.Click for the full glossary entry secures DNS” is true only for one property, authenticity of answers, and only where both ends take part.

Cloudflare signs its own domainIn plain words: The easy-to-read name of a website or email sender, like example.com. In an email from sam@example.com, the domain is the part after the @.Technical: A name registered in the global naming system, made of labels separated by dots, and resolved to addresses by DNS.Click for the full glossary entry, so you can see real DNSSECIn plain words: A tamper-proof seal on DNS answers. It lets your computer check that a website’s address answer was not faked on the way. It does not hide or encrypt anything.Technical: DNS Security Extensions. Adds digital signatures (RRSIG, DNSKEY, DS records) forming a chain of trust from the root zone down. A validating resolver rejects answers whose signatures do not check out.Click for the full glossary entry records:

> nslookup -type=DNSKEY cloudflare.com

You get long lines of key data. You do not need to read them. The fact that they exist is the point: the domain publishes public keys.

For a clearer view, use a free web tool: type a domain into dnsviz.net, which draws the whole chain of trust from the root down, or into Verisign’s DNSSEC debugger. Try cloudflare.com and then stashgrid.ai and see which is signed.

In PowerShell on Windows, Resolve-DnsName cloudflare.com -Type A -DnssecOk also shows the signature (RRSIG) record next to the answer.

Why this matters. Seeing a signed domain next to an unsigned one is how you learn what “DNSSEC-enabled” actually looks like.

A deliberately broken test domainIn plain words: The easy-to-read name of a website or email sender, like example.com. In an email from sam@example.com, the domain is the part after the @.Technical: A name registered in the global naming system, made of labels separated by dots, and resolved to addresses by DNS.Click for the full glossary entry, dnssec-failed.org, has long been used for this. Its signatures are wrong on purpose. A resolverIn plain words: The helper that looks up names for you, like a receptionist who knows who to ask. Your router or internet provider normally runs it.Technical: A server that answers DNS questions for clients, asking other DNS servers if it does not already know and remembering answers for a while (caching).Click for the full glossary entry that validates refuses to answer; one that does not validate hands you an address.

> nslookup dnssec-failed.org
> nslookup dnssec-failed.org 1.1.1.1

• The first uses your own resolver. If it prints an address, your resolver is not checking DNSSECIn plain words: A tamper-proof seal on DNS answers. It lets your computer check that a website’s address answer was not faked on the way. It does not hide or encrypt anything.Technical: DNS Security Extensions. Adds digital signatures (RRSIG, DNSKEY, DS records) forming a chain of trust from the root zone down. A validating resolver rejects answers whose signatures do not check out.Click for the full glossary entry. If it fails with a server failure error, it is.
• The second asks Cloudflare’s 1.1.1.1, which does validate, so you should see the failure.

If the test domain no longer behaves like this, use dnsviz.net instead. Test sites come and go.

Why this matters. DNSSEC only protects you if your resolver validates. This shows whether it does. Public resolvers such as 1.1.1.1, 8.8.8.8 and 9.9.9.9 validate.

The standards are finished and the technology works as designed. Adoption is the problem.

• Most top-level domains are signed (about 92% of them in 2023, according to CircleID).
• Only about 7% of domains were signed in 2025 (APNIC and CircleID), and roughly 5% of .com in 2024 (DigiCert).
• About 36% of users were behind validating resolversIn plain words: The helper that looks up names for you, like a receptionist who knows who to ask. Your router or internet provider normally runs it.Technical: A server that answers DNS questions for clients, asking other DNS servers if it does not already know and remembering answers for a while (caching).Click for the full glossary entry in 2025 (APNIC).

Why so low?

• Complexity. Keys must be rolled over regularly, and the fingerprint at the parent has to be updated at exactly the right moment. A slip can break the domainIn plain words: The easy-to-read name of a website or email sender, like example.com. In an email from sam@example.com, the domain is the part after the @.Technical: A name registered in the global naming system, made of labels separated by dots, and resolved to addresses by DNS.Click for the full glossary entry.
• Failure is loud. If signatures expire or a key change goes wrong, validating resolvers reject the domain, so it looks “down” to many users while still working for others. That makes it hard to diagnose.
• New risks. A flaw called KeyTrap, reported in 2024, let one crafted answer burn a validating resolver’s CPU.
• The benefit is partial. HTTPS already stops most fake-site tricks, so many organisations decide DNSSECIn plain words: A tamper-proof seal on DNS answers. It lets your computer check that a website’s address answer was not faked on the way. It does not hide or encrypt anything.Technical: DNS Security Extensions. Adds digital signatures (RRSIG, DNSKEY, DS records) forming a chain of trust from the root zone down. A validating resolver rejects answers whose signatures do not check out.Click for the full glossary entry is not worth the risk of an outage.
• Waiting on each other. Domain owners do not sign because few resolvers check, and resolvers have less reason to check because few domains are signed.

The fair verdict. Calling it a failure is too harsh, because it does what it was designed to do for the domains that use it, and some governments and country domains have rolled it out widely. Calling it “the fix for DNSIn plain words: The internet’s phone book. You type an easy name like stashgrid.ai, and DNS looks up the number address that computers really use, the way a street address tells the mail carrier where to go.Technical: Domain Name System. A worldwide set of servers that turns names into IP addresses. Your device asks a DNS server (usually your router or your provider) every time you visit a site.Click for the full glossary entry security” is too generous, because most domains are not covered and the things it leaves out (privacy, phishingIn plain words: A fake email, text or website that pretends to be someone you trust, like your bank, to trick you into giving up a password or money.Technical: Social engineering by message. Typical signs are urgency, a mismatched sender domain, a link that does not go where it says, and a request for credentials or payment.Click for the full glossary entry, the last step) are the problems most people face. It is an incomplete answer to one real problem.

What actually helps you now. Use a validating resolver. Use HTTPS (your browser does). Consider encrypted DNS (DNS over HTTPS or TLS) for privacy. And if you own a domain, sign it only if your DNS provider handles key rollovers for you automatically.

Both the people who say DNSSEC is essential and the people who say it is useless are describing a different corner of it. Be able to name the corner. — Nyx