# What is DNSSEC?

> DNSSEC adds cryptographic signatures to DNS data, letting resolvers verify that an answer came from the authoritative zone and was not altered in transit.

- Canonical URL: https://yellowcube.eu/glossary/domain-name-system-security-extensions/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

DNS was designed without authentication, so forged answers — cache poisoning, hijacked responses — can redirect users silently. DNSSEC signs zone data with the zone’s keys and chains trust through parent zones, allowing validating resolvers to detect tampered or spoofed answers.

### Key points

- **Scope of protection:** DNSSEC proves data origin and integrity — it does not encrypt queries, hide lookups, or stop the domain itself from pointing somewhere malicious.
- **Deployment chain:** The zone must be signed, the parent must publish the delegation signer, and resolvers must validate; each link can fail independently.
- **Important limitation:** Validation failures look like outages, and key rollover mistakes can take a domain offline. DNSSEC also does nothing against compromised authoritative servers, account-level hijacks at the registrar, or non-DNS attack paths.

### Related terms

[Domain Name System (DNS) security](<https://yellowcube.eu/glossary/domain-name-system-security/>) · [Domain Name System (DNS)](<https://yellowcube.eu/glossary/domain-name-system/>) · [Domain Name System (DNS) cache poisoning](<https://yellowcube.eu/glossary/domain-name-system-cache-poisoning/>) · [Domain Name System (DNS) hijacking](<https://yellowcube.eu/glossary/domain-name-system-hijacking/>) · [Protective DNS](<https://yellowcube.eu/glossary/protective-dns/>)

### Sources

[IETF RFC 4033–4035, DNS Security Extensions](https://www.rfc-editor.org/rfc/rfc4033.html) · [NIST SP 800-81 Rev. 3, Secure Domain Name System Deployment Guide](https://csrc.nist.gov/pubs/sp/800/81/r3/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.