DNSSEC
acronymnetworkingsecurity
Stands for: Domain Name System Security Extensions
Extensions that let DNS answers be cryptographically verified.
Domain Name System Security Extensions (RFC 4033) add signatures to DNS records so a resolver can prove an answer came from the real zone and was not tampered with in transit. It builds a chain of trust from the root down through each delegation.
DNSSEC signs DNS records so a resolver can verify the answer came from the zone's owner and was not altered in transit, with a chain of trust running from the root down through each delegation.
What it does not do is confidentiality: the query and the answer remain visible, which is what encrypted transport addresses separately. Its deployment has been slow because the operational burden is real, key rollovers must be sequenced correctly, and a signing mistake fails closed, taking the zone offline for validating resolvers rather than degrading quietly. That failure mode is correct and it means DNSSEC turns a silent risk into a visible outage, which is a trade organizations have been slow to accept.
Also known as: dnssec