DNSSEC
DNS Security Extensions: digital signatures on DNS records that let resolvers verify an answer came from the zone owner and was not altered.
What it means
With DNSSEC, a zone signs its records (RRSIG), publishes its public keys (DNSKEY), and has a hash of its key (DS) placed in the parent zone. Resolvers that validate follow the chain of trust from the root and reject forged or modified answers. RFC 4033 notes it provides origin authentication and integrity, not confidentiality.
For mail it is the foundation of DANE: TLSA records only count when DNSSEC validates them, and REQUIRETLS accepts a DNSSEC-signed MX as proof of the right server. It also protects MX, SPF and DKIM records from spoofed DNS answers.
Enabling it involves both your DNS host (signing) and your registrar (publishing DS). A mismatch after changing hosts makes the domain unresolvable for validating resolvers, so plan moves carefully.
Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 4033: DNS Security Introduction and Requirementsrfc-editor.org
- ICANN: DNSSEC, what is it and why is it importanticann.org
- Microsoft Learn: How SMTP DANE workslearn.microsoft.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes