DNSSEC

DNS was not originally built with any way to verify that an answer was genuine. Ask “what server handles this domain” and whatever answer comes back gets trusted, even if it was quietly swapped out along the way by someone sitting between you and the real answer. DNSSEC, short for DNS Security Extensions, closes that gap by attaching a cryptographic signature to DNS answers, so a resolver can check the signature and know the answer was not altered.

It works alongside your ordinary DNS records rather than replacing them. The records still say what they always said. DNSSEC adds a layer of proof on top, so the software looking things up can catch a forged or tampered answer instead of trusting it blindly.

Why it matters to you

The attack DNSSEC prevents is called DNS spoofing or cache poisoning, and it is not common for a small local business, but it is not nothing either. A convincing fake answer can redirect visitors, or worse, redirect their mail, to a server the attacker controls, all without touching your website’s code or your hosting account at all. The vulnerability lives at the DNS layer, underneath everything else you have secured.

It is also one of the checks that shows up on security questionnaires and insurance forms, the same category as security headers. Having it enabled answers a box on a form without you needing to explain what it does.

How I set it up

DNSSEC has to be turned on in two places that agree with each other: at the domain registrar, which publishes a record vouching for your DNS host’s signing key, and at the DNS host itself, which does the actual signing. I turn it on at the DNS provider first, then add the matching record at the registrar. Doing it in the wrong order, or leaving one side out, can make a domain unreachable rather than more secure, so I check both sides are in sync before considering it done.

Most modern registrars and DNS providers, including Cloudflare, make this closer to a single toggle than a manual configuration these days, but I still verify the result with an independent DNSSEC checking tool rather than trusting the toggle’s own status page.

What it looks like in practice

Nothing changes for a visitor. No lock icon, no message, no delay. What changes is what happens underneath, invisible to anyone but the software making the DNS lookup. If you run a DNSSEC validation check against your domain after I turn it on, it comes back green. That is the entire visible result, and for a security feature that is exactly how it should be.