Suggest an editImprove this articleRefine the answer for “What is DNSSEC?”. Your changes go to moderation before they’re published.Approval requiredContentWhat you’re changing🇺🇸EN🇺🇦UAPreviewTitle (EN)Short answer (EN)**DNSSEC (Domain Name System Security Extensions)** is a **set of extensions for DNS** that adds **cryptographic protection for DNS responses** and makes it possible **to verify that DNS data is authentic and has not been tampered with**. **Key point:** DNSSEC does not encrypt data, it signs it - it guarantees the correctness of DNS, but it does not protect a site's content and does not replace HTTPS.Shown above the full answer for quick recall.Answer (EN)Image**DNSSEC (Domain Name System Security Extensions)** is a **set of extensions for DNS** that adds **cryptographic protection for DNS responses** and makes it possible **to verify that DNS data is authentic and has not been tampered with**. In simpler terms: **DNSSEC protects DNS from response spoofing**. --- ## What problem DNSSEC solves Ordinary DNS: - **does not verify the authenticity of a response** - the client trusts whoever answers first This allows attacks such as: - spoofing a site's IP address - redirecting to a phishing server - *DNS spoofing / cache poisoning* attacks **DNSSEC solves exactly this problem**. --- ## What DNSSEC actually does DNSSEC provides **two key things**: ### 1. Authenticity of data The client can verify: - that the DNS response came **from the real authoritative server** - and not from an attacker --- ### 2. Integrity of data The client makes sure that: - the DNS record **was not altered along the way** - the IP address is really the one the domain owner specified Important: DNSSEC **does not encrypt data**, it **signs it**. --- ## How DNSSEC works (simplified) 1. The DNS zone **is signed with a cryptographic key** 2. **Digital signatures** are created for the records 3. The client receives: - the DNS record - the signature for it 4. The client verifies the signature via a **chain of trust**: - from the domain - to the zone - to the DNS root zone 5. If verification succeeds, the response can be trusted If the signature does not match, the response **is discarded**. --- ## What DNSSEC does NOT do This is a favorite interview question: DNSSEC **does not encrypt DNS requests** DNSSEC **does not hide which domains you are querying** DNSSEC **does not replace HTTPS** DNSSEC: - guarantees the **correctness of DNS** - but **does not protect a site's content** --- ## Where DNSSEC is used DNSSEC: - is configured at the domain level - is supported by many registrars - is used in critical zones (banks, government services) But: - deployment is more complex than plain DNS - so it is **not used everywhere** --- ## Real-life example Ordinary DNS is like an address on a piece of paper: - anyone can alter it DNSSEC is like an address: - with a notary's seal - a forgery is easy to detect --- ## Short interview answer Remember this formulation: > **DNSSEC is a DNS extension that adds a cryptographic signature to DNS records and makes it possible to verify the authenticity and integrity of DNS responses, protecting against their spoofing.**For the reviewerNote to the moderator (optional)Visible only to the moderator. Helps review go faster.