What is DNSSEC?

Classic DNS is unsigned. Anyone who can spoof a response can send a browser to the wrong IP. DNSSEC adds signatures so a validating resolver can tell.

You generate keys, sign the zone, and publish DNSKEY records. Each set of records (an RRset) gets an RRSIG. The parent zone publishes a DS record that hashes your key, chaining trust up to the signed root. A validating recursor walks that chain. If a signature is missing or wrong, the answer is SERVFAIL, not a silent lie.

Operational reality

DNSSEC fails closed. Expired signatures take a domain offline for validating resolvers. If you enable it, you need a host that rolls keys and re-signs automatically. Transferring a domain to a registrar that does not copy DS records is a common outage. Disabling DNSSEC means removing DS at the parent first, waiting, then turning off signing.

DNSFetch’s lookups show the unsigned record data resolvers return for everyday types. They are not a full DNSSEC auditor. Use dig +dnssec or your provider’s debugger when signatures misbehave. Enabling HTTPS does not replace DNSSEC; they cover different hops.