DNS was designed without authentication, so forged answers — cache poisoning, hijacked responses — can redirect users silently. DNSSEC signs zone data with the zone’s keys and chains trust through parent zones, allowing validating resolvers to detect tampered or spoofed answers.
Key points
Scope of protectionDNSSEC proves data origin and integrity — it does not encrypt queries, hide lookups, or stop the domain itself from pointing somewhere malicious.
Deployment chainThe zone must be signed, the parent must publish the delegation signer, and resolvers must validate; each link can fail independently.
Important limitationValidation failures look like outages, and key rollover mistakes can take a domain offline. DNSSEC also does nothing against compromised authoritative servers, account-level hijacks at the registrar, or non-DNS attack paths.