In short
DNSSEC (DNS Security Extensions) adds digital signatures to DNS records so a validating resolver can confirm an answer really came from the domain's owner and was not altered. It protects against spoofing and cache poisoning, but it does not encrypt lookups or block malicious domains. Sign your own domains where your DNS host supports it, and use a validating resolver.
Get a quote for DNS security
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What DNSSEC is
The Domain Name System was designed in the 1980s with no way to prove that an answer is genuine. A resolver asks a question and trusts the reply. That leaves room for attackers to supply false answers, which is the basis of DNS spoofing and cache poisoning.
DNSSEC, the DNS Security Extensions, was standardised in RFCs 4033, 4034 and 4035 in 2005. It adds digital signatures to DNS data so that a resolver can check two things: that the data came from the zone's genuine owner (origin authentication) and that it was not changed on the way (data integrity). It also lets a resolver prove that a name genuinely does not exist.
It does this with a few extra record types:
- DNSKEY records hold the zone's public keys.
- RRSIG records hold the signatures over each set of records.
- DS (delegation signer) records, held in the parent zone such as .co.uk or .com, vouch for the child zone's key. This builds a chain of trust from the DNS root down to your domain.
- NSEC or NSEC3 records prove that a name does not exist.
A resolver that validates DNSSEC follows that chain. If the signatures do not check out, it refuses to return the answer, so the user gets an error rather than a forged address.
What DNSSEC protects against, and what it does not
DNSSEC is precise about its job. The RFCs state plainly that it does not provide confidentiality.
| Threat | Does DNSSEC help? | Notes |
|---|---|---|
| Forged answers and cache poisoning | Yes | A validating resolver rejects records that are not correctly signed |
| Tampering with answers in transit | Yes | Altered records fail validation |
| Someone reading your lookups | No | DNSSEC adds no encryption; that is what encrypted DNS is for |
| Phishing, malware and command-and-control domains | No | A criminal can sign their own malicious domain; blocking needs protective DNS |
| Registrar account takeover | Limited | An attacker who controls your registrar account can change the DS record; see DNS hijacking |
| A device configured to use a rogue resolver | Limited | Only helps if validation happens on a resolver the device can trust |
So DNSSEC is one layer, focused on the authenticity of DNS data. It sits alongside the other two layers covered on this site: encryption of the lookup, and blocking of malicious destinations.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
DNSSEC vs encrypted DNS vs protective DNS
These three are often mixed up, including in searches such as "DNSSEC vs secure DNS". Microsoft describes DNS encryption and DNSSEC as complementary technologies that address different threats: encryption protects DNS traffic on the wire, while DNSSEC verifies that DNS data is authentic.
| DNSSEC | Encrypted DNS (DoH, DoT) | Protective DNS | |
|---|---|---|---|
| Main question it answers | Is this answer genuine? | Can anyone read or change the lookup in transit? | Should this domain be reachable at all? |
| How | Digital signatures on DNS records | TLS or HTTPS between device and resolver | Threat intelligence and policy on the resolver |
| Who sets it up | Domain owners sign; resolvers validate | Device, browser and resolver | Your organisation, through a provider |
| Stops spoofing | Yes, with validation | Only on the device-to-resolver hop | Not by itself |
| Keeps lookups private | No | Yes, from the network | No |
| Blocks phishing and malware | No | No | Yes |
Most organisations benefit from all three: DNSSEC on their own domains, encrypted DNS to a protective resolver for their devices, and that resolver validating DNSSEC. Our guide to DNS security best practices puts them in order.
Is DNSSEC worth it?
There are two separate decisions here, and the answer is different for each.
Validating DNSSEC on the resolvers your devices use is worth it for almost everyone, because it is a feature of the resolver rather than something you build yourself. The NCSC's guidance on protective DNS asks buyers to make sure providers support DNSSEC, and to check what the provider does to protect against spoofing and hijacking. DNSFilter, for example, lists DNSSEC validation among its features. Ask any provider whether its resolvers validate; we can check this for the services we supply.
Signing your own domains is worth considering for most UK organisations, particularly if you handle payments, logins or sensitive email, because it makes it much harder to forge your DNS records for anyone using a validating resolver. The practical questions are:
- Does your DNS host support DNSSEC signing, ideally with automatic key management?
- Can your registrar publish the DS record in the parent zone?
- Who will monitor it, so that an expired signature or a botched key change is noticed before it breaks the domain?
The main risk of DNSSEC is operational. If signatures expire, or keys are changed without updating the DS record, validating resolvers will treat your domain as broken and refuse to resolve it. Managed signing by your DNS host removes most of that risk.
Is DNS security the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Common DNSSEC mistakes to avoid
Most DNSSEC problems are self-inflicted and happen during routine changes. The ones to plan for:
- Letting signatures expire. RRSIG records have an expiry date. If signing stops, for example because a server or service was retired, validating resolvers start rejecting the domain when the signatures run out.
- Changing DNS host without updating the DS record. If you move a signed domain to a new DNS host, the DS record at the registrar must match the new host's keys, or be removed before the move. A mismatch makes the domain fail validation.
- Key changes done in the wrong order. Replacing signing keys (a key rollover) has to follow a sequence so resolvers see a valid chain throughout. Managed signing by your DNS host handles this for you.
- Unsigned subdomains delegated elsewhere. A subdomain hosted by another provider needs its own signing and DS record, or a deliberate decision that it stays unsigned.
- No monitoring. A DNSSEC fault looks to users like the website or email has simply stopped working. Check your domains regularly with the tools below, and after any DNS change.
None of these is a reason to avoid DNSSEC, but they are a reason to choose a DNS host that automates signing and to make DNSSEC part of your change process.
How to check DNSSEC on your domain
You can check whether a domain is signed, and whether the chain of trust is intact, with free public tools:
- DNSViz (dnsviz.net), a free DNS visualisation tool, draws the full chain of trust from the root to your domain and highlights errors.
- DNSSEC Debugger from Verisign Labs (dnssec-debugger.verisignlabs.com) runs a step-by-step check of each link in the chain.
- Command-line tools: dig with the +dnssec option shows RRSIG records alongside answers, and delv, which ships with BIND, performs full validation.
- Your registrar's control panel should show whether a DS record is published for the domain.
If the tools show no DNSKEY or DS records, the domain is not signed. If they show errors, talk to your DNS host before making changes. For a wider check of how your organisation's DNS is protected, including the resolvers your devices use, see our DNS security test guide.
How we help
DNSSEC signing for your domains is set up with your DNS host and registrar. Forever Systems can review your domains' DNSSEC status as part of a wider DNS security review, explain what we find, and help you put the other layers in place: protective DNS resolvers that validate DNSSEC, encrypted DNS for your devices, registrar locks and multi-factor authentication on DNS accounts.
As a Cisco Partner we supply Cisco DNS-layer security, and we also supply DNSFilter, Webroot DNS Protection and other options compared on our DNS security solutions page. Contact us to talk it through; scope is confirmed at quote, so ask us for a quote.
How Forever Systems helps with DNS security
We are an independent UK IT and cyber security provider and a Cisco Partner. We supply Cisco Umbrella and Cisco Secure Access DNS Defense, and a range of other DNS filtering options, so we can recommend what fits rather than one answer for everyone.
- Start with what you have: we look at your firewall, endpoint protection and Microsoft 365 licences first, as some already include DNS or web filtering
- Choosing a service: Cisco DNS-layer security, DNS filtering bundled with endpoint protection, or a protective DNS service from the public sector, compared in plain English
- Set-up and roll-out: network forwarding, roaming clients for laptops off site, policies, block pages and controls to stop encrypted DNS bypassing the filter
- Migration help, including planning a move from Umbrella DNS packages to Cisco Secure Access DNS Defense
- Ongoing help: policy changes, reporting reviews, licence management and renewals, agreed at quote
We work with businesses, schools, charities and public sector organisations.
Frequently asked questions
What is DNSSEC?
DNSSEC (DNS Security Extensions) adds digital signatures to DNS records so a validating resolver can check that an answer came from the domain's real owner and was not changed. It is defined in RFCs 4033 to 4035 and protects against spoofing and cache poisoning.
Is DNSSEC worth it?
Validating DNSSEC on your resolvers is worth it for almost everyone. Signing your own domains is worth considering for most organisations, provided your DNS host supports it and someone monitors it, because expired signatures or a mishandled key change can make the domain unreachable.
What is the difference between DNSSEC and encrypted DNS?
DNSSEC proves DNS answers are genuine but does not hide them. Encrypted DNS (DNS over HTTPS or DNS over TLS) hides lookups from the network but does not prove the answers are genuine. They are complementary, and neither blocks malicious domains.
How do I check DNSSEC on my domain?
Use a free tool such as DNSViz or Verisign Labs' DNSSEC Debugger, or run dig with the +dnssec option. If there are no DNSKEY or DS records, the domain is not signed. Your registrar's control panel should also show whether a DS record is published.
Does DNSSEC stop phishing?
No. DNSSEC confirms that records are genuine, but a criminal can sign their own phishing domain. Blocking phishing and malware domains needs protective DNS, alongside email security and user awareness.
Still have a question about DNS security?
Ask us and a member of our team will reply by email.