What Is DNSSEC? Why It Matters for Your Business

DNS is fundamental to how the internet works, but how do you know that the DNS information your systems receive can be trusted? DNSSEC helps answer that question.

Every time someone visits your website, sends an email or connects to an online service, the Domain Name System (DNS) plays an important role.

DNS translates familiar domain names, such as example.com, into the technical information computers need to locate services on the internet.

Most of the time, this happens invisibly and almost instantly.

But traditional DNS has a significant weakness: it was not originally designed to verify that the information returned by a DNS server is authentic.

This creates an opportunity for attackers to interfere with DNS responses and potentially redirect users towards malicious destinations.

DNSSEC (Domain Name System Security Extensions) was developed to address this weakness.

What is DNSSEC?

DNSSEC is a set of security extensions that adds cryptographic authentication to DNS.

It allows DNS resolvers that support validation to verify that DNS information genuinely originates from the appropriate DNS zone and has not been altered.

In simple terms, DNSSEC helps answer two important questions:

• Did this DNS information come from the correct source?

• Has the information been changed since it was digitally signed?

DNSSEC achieves this using digital signatures and a chain of trust that connects a domain's DNS records to trusted information higher in the DNS hierarchy.

Importantly, DNSSEC does not encrypt DNS traffic. Its purpose is to authenticate DNS data, not to keep DNS queries private.

Why does DNSSEC matter?

Imagine that a customer enters your website address into their browser.

Normally, DNS provides the information needed to connect the customer to your website.

However, if an attacker successfully manipulates an unprotected DNS response, the customer could be directed to a different server.

That server might display a convincing copy of your website, attempt to steal credentials or deliver malicious content.

DNSSEC helps protect against attacks that rely on forged or modified DNS responses.

This is particularly relevant for organisations operating customer portals, SaaS applications, e-commerce services and other internet-facing systems.

DNSSEC and DNS cache poisoning

One of the attacks DNSSEC was designed to help prevent is DNS cache poisoning.

DNS resolvers frequently cache responses to improve performance. If an attacker manages to insert false information into that cache, subsequent users may receive incorrect DNS information.

For example, a cached DNS record could point portal.example.com towards an attacker-controlled server instead of the legitimate service.

With DNSSEC validation enabled, forged DNS data without a valid cryptographic signature should be rejected.

This significantly reduces the effectiveness of DNS cache-poisoning attacks against properly signed and validated domains.

How does DNSSEC work?

DNSSEC uses public-key cryptography to create a verifiable chain of trust.

The process involves three important components.

DNSKEY records publish the public keys used to verify DNS signatures.

RRSIG records contain digital signatures for sets of DNS records.

DS (Delegation Signer) records establish a link between a parent DNS zone and a signed child zone.

Together, these records allow a validating DNS resolver to check whether a response can be trusted.

For example, when validating records for example.com, the resolver can follow the chain of trust from the DNS root through the .com zone to the domain itself.

DNS Root

Trusted starting point

.com Parent Zone

DS record links to the child zone

example.com

DNSKEY and RRSIG records authenticate DNS data

Validated DNS Response

A validating resolver accepts authenticated records

Illustrative DNSSEC chain of trust. Validation also includes checking signatures, algorithms and validity periods.

If any required part of the chain fails validation, a validating resolver will normally reject the response.

This is one of DNSSEC's greatest strengths, but it also introduces an important operational consideration.

What happens if DNSSEC is configured incorrectly?

A DNSSEC configuration problem can make an otherwise healthy website or application appear unavailable.

For example, consider an organisation that moves its DNS hosting from one provider to another.

The original DNS provider supported DNSSEC, and the domain registrar contains a DS record pointing to the original provider's signing key.

If the organisation moves its DNS records without correctly updating or removing the DS record, DNSSEC validation may fail.

The website itself could be running perfectly, but users relying on validating DNS resolvers may be unable to reach it.

Typical symptoms include DNS resolution failures, intermittent accessibility and SERVFAIL responses.

This is why DNSSEC should not simply be enabled and forgotten.

A correctly configured DNSSEC deployment improves security. An incorrectly configured deployment can affect availability.

Does every business need DNSSEC?

DNSSEC is worth considering for most organisations that operate their own domains, particularly where those domains support important business services.

It is especially relevant for SaaS providers, organisations handling sensitive customer information, online retailers, financial services and businesses dependent on internet-facing applications.

However, DNSSEC is only one part of DNS security.

It does not replace HTTPS, prevent all forms of phishing, stop unauthorised changes at your domain registrar or protect against every type of DNS attack.

It should form part of a broader approach that includes secure domain registration, appropriate access controls, DNS monitoring and certificate management.

How can you check whether DNSSEC is enabled?

You do not need to understand cryptographic algorithms to carry out an initial DNSSEC assessment.

A DNSSEC checker can examine publicly available DNS information and determine whether a domain appears to be configured for DNSSEC.

A useful check should distinguish between several conditions.

A domain without DNSSEC is not necessarily malfunctioning. It simply does not provide DNSSEC authentication for its DNS responses.

A domain with broken DNSSEC is a different situation and may require urgent attention.

Check your domain with SaaS Sentinel

SaaS Sentinel provides a free DNSSEC Checker to help domain owners and SaaS developers assess their DNSSEC configuration.

Rather than manually inspecting DNS records, you can use the checker to establish whether your domain is protected and identify potential configuration issues.

Visit SaaS Sentinel to access the free DNSSEC Checker

Should you enable DNSSEC yourself?

Many DNS hosting providers offer DNSSEC as a managed feature, making initial activation relatively straightforward.

However, enabling DNSSEC may involve coordination between your DNS hosting provider and your domain registrar.

The most important consideration is ensuring that the signing keys, DNSKEY records and parent-zone DS records are correctly aligned.

Before enabling DNSSEC, confirm that your provider supports it, understand how key rotation is handled and establish a procedure for future DNS migrations.

For business-critical domains, it is also sensible to schedule the change, validate the configuration afterwards and ensure that you have a recovery procedure.

DNSSEC should be part of ongoing domain management

Domain security is not a one-time configuration exercise.

DNS providers change, domains are transferred, signing keys rotate and services are migrated.

Each of these events can introduce DNSSEC configuration issues if the changes are not carefully managed.

For organisations operating multiple SaaS applications, keeping track of DNS security across numerous domains becomes another operational responsibility.

Regular checks help identify problems before they become service-impacting incidents.

This is consistent with a wider principle of effective technology management: security controls need to be monitored and maintained, not simply deployed.

Conclusion

DNSSEC addresses an important weakness in traditional DNS by providing a mechanism for authenticating DNS information.

It helps protect against forged DNS responses and cache poisoning, providing additional confidence that users are being directed towards the intended services.

But DNSSEC must be configured correctly and maintained as domains and DNS infrastructure change.

Whether you manage a single business website or a portfolio of SaaS applications, understanding your DNSSEC status is a sensible part of maintaining secure and reliable online services.

Start by checking your domain's DNSSEC configuration. Then make sure it remains correct as your infrastructure evolves.

Frequently Asked Questions

Authoritative references

• ICANN — DNSSEC: What Is It and Why Is It Important?

• Cloudflare — Troubleshooting DNSSEC