DNSSEC: authenticity checks for the internet's phone book

Every time you open a website, your device asks DNS: "Which address belongs to this name?" DNS is the phone book of the internet. The problem: an ordinary DNS answer carries no proof of authenticity. Anyone in the right position can slip you a forged address — and you end up on someone else's server without noticing.

What DNSSEC does

DNSSEC attaches digital signatures to DNS answers. Your resolver can then check: did this answer really come from the responsible name server, or was it tampered with in transit? If the signature is invalid, the answer is discarded — better no connection than one to a fraudster.

The chain of trust

The elegant part is the chain: the root of DNS signs the top-level domains, those sign the individual domains, and so on. Each level vouches for the next. Your resolver only needs to trust the root and can verify the rest all the way down.

What it gives you — and what it doesn't

DNSSEC ensures the address is genuine. It does not encrypt the content of your connection — that's the job of HTTPS. The two complement each other: DNSSEC gets you to the right server, HTTPS makes sure nobody reads along.

A nice side effect: only with DNSSEC can further security mechanisms be reliably anchored in DNS — such as stating which certificate a mail server must use. Without the authenticity guarantee of DNSSEC, such statements would be worthless.