What is DNSSEC and why does it matter?

DNSSEC (Domain Name System Security Extensions) adds authentication to DNS responses using public-key cryptography.

The problem DNSSEC solves: Without DNSSEC, DNS responses are unsigned. An attacker can:

• DNS cache poisoning: Inject fake DNS records into resolver caches
• Man-in-the-middle: Redirect traffic by spoofing DNS responses
• Domain hijacking: Redirect email or web traffic to malicious servers

How DNSSEC works:

1. Zone owner signs DNS records with a private key
2. Public key (DNSKEY) is published in DNS
3. Parent zone (e.g., .com) vouches for the key via DS record
4. Resolvers verify signatures before trusting responses

Chain of trust:

Root (.) → TLD (.com) → Your domain (example.com) → Records (A, MX, TXT)
  DS→DNSKEY   DS→DNSKEY      DS→DNSKEY              RRSIG signatures

DNSSEC adoption by TLD:

• .nl — 97% signed (highest in the world)
• .com — ~7% signed
• .org — ~5% signed
• .ai — No DNSSEC support (Anguilla ccTLD limitation)

Should you enable DNSSEC? Yes, if your TLD and registrar support it. Benefits:

• Prevents DNS spoofing attacks
• Enables DANE (TLSA records for email/web TLS)
• Required for some government compliance standards
• Google and Cloudflare resolvers validate DNSSEC

How to check: Scan your domain at https://intodns.ai — the DNSSEC section shows validation status, DS records, and signing algorithms.