What is DNSSEC?
DNSSEC adds digital signatures so resolvers can verify DNS data origin and integrity. It does not encrypt the query.
How it works and where it is used
1. How it works Zones sign records with private keys; resolvers check signatures using public keys and a chain of trust from the parent. DNSKEY, DS and RRSIG records participate. 2. Applications and examples It helps reject forged DNS answers such as cache poisoning. Domain operators sign zones, and validating resolvers check them; HTTPS security still matters.
Limits and good practice
3. Limitations and security Expired signatures, bad key rollovers or missing DS records can break a legitimate domain. DNSSEC does not hide queries, so key management is critical. 4. Practical considerations Coordinate registrar and DNS provider, plan rollovers, test with multiple resolvers and monitor signature expiry. Do not disable trust arbitrarily during failures.