Guide
What is DNSSEC?
DNSSEC signs DNS answers cryptographically, so a resolver can prove the record it received is the one the domain actually published and was not tampered with in transit.
The problem it solves
Plain DNS has no authentication. A resolver asks a question and believes the answer, which makes cache poisoning and on-path tampering possible: an attacker who can answer first sends your visitors somewhere else, and nothing about the reply looks wrong.
DNSSEC attaches a signature to each record set. A validating resolver checks that signature against a chain of trust that runs from your zone, up through your parent registry, to the DNS root.
The records involved
DNSKEY publishes the zone's public keys. RRSIG carries the signature over each record set. DS sits at the **parent** — at your registry, not in your zone — and fingerprints your key, which is the link that joins your zone to the chain above it.
NSEC and NSEC3 handle proving that a name does *not* exist, which a signed zone must also be able to do.
Turning it on
Most DNS hosts make this one switch, after which you copy a DS record to your registrar. Both halves are required: signing the zone without publishing the DS achieves nothing, because no resolver knows to check.
Broken DNSSEC is far worse than no DNSSEC
Once a DS record exists at the parent, validating resolvers *insist* on a correct signature. If signing breaks, they do not fall back to the unsigned answer — they refuse to answer at all, and the domain becomes invisible to a large share of the internet including Google's and Cloudflare's public resolvers. Signatures also expire on a schedule, so this can happen with no change on your side, at a moment nobody is watching. It is the one item on a DNS report where "enabled" and "working" must be checked separately.
Check whether your zone validates.
Check a domain