Question 1

What is DNSSEC?

Accepted Answer

DNSSEC (Domain Name System Security Extensions) is a suite of specifications that cryptographically signs DNS records. When a DNS resolver queries for a domain, DNSSEC allows it to verify that the response was not tampered with in transit — protecting against DNS cache poisoning, DNS spoofing, and man-in-the-middle attacks on DNS.

Question 2

How does DNSSEC protect my domain?

Accepted Answer

Without DNSSEC, an attacker who can intercept DNS traffic can redirect users to a malicious server by returning false DNS records — even if the domain has a valid SSL certificate. DNSSEC prevents this by signing DNS records with a private key, and the resolver validates these signatures using a public key chain anchored at the DNS root.

Question 3

Is DNSSEC mandatory?

Accepted Answer

DNSSEC is not universally mandatory, but it is required for some government TLDs and strongly recommended for all critical domains. It is a defense-in-depth measure — even if your SSL certificate is valid, DNS spoofing can still direct users to fake servers. PCI DSS v4.0 includes guidance around DNS security.

Question 4

What does DNSKEY and DS mean?

Accepted Answer

DNSKEY records contain the public cryptographic key used to sign DNS records for a zone. DS (Delegation Signer) records are stored in the parent zone (e.g. the .com registry) and contain a hash of the child zone's DNSKEY, creating the chain of trust up to the DNS root.

Question 5

How do I enable DNSSEC for my domain?

Accepted Answer

DNSSEC is typically enabled at two places: your DNS hosting provider (who signs the zone and creates DNSKEY records) and your domain registrar (who publishes the DS record to the parent TLD registry). Most major DNS providers like Cloudflare, AWS Route 53, and Google Cloud DNS support DNSSEC. Enable it in your DNS provider dashboard and then add the DS record to your registrar.

Question 6

What is the AD bit in a DNS response?

Accepted Answer

The AD (Authenticated Data) bit is set by a validating DNS resolver to indicate that the response has been verified against DNSSEC signatures. If a resolver returns AD=true, it means the DNS data is cryptographically authenticated. Our checker uses Cloudflare's DNS-over-HTTPS (DoH) resolver, which performs full DNSSEC validation.

Free DNSSEC Checker

Frequently Asked Questions about DNSSEC