DNS Security Extensions (DNSSEC)
Why DNSSEC Matters
Without DNSSEC, DNS responses are not authenticated. An attacker who can intercept or modify DNS traffic (through cache poisoning, BGP hijacking, or compromised resolvers) can redirect users to malicious servers without any indication that something is wrong. The victim's browser would show a valid HTTPS connection to the correct domain, but the server would be controlled by the attacker if they also obtained a certificate.
DNSSEC prevents this by signing DNS records with cryptographic keys. A validating resolver checks the signatures and rejects responses that fail validation. This stops cache poisoning attacks at the DNS level, before the connection reaches the application layer.
DNSSEC adoption has been slower than HTTPS adoption due to operational complexity. Misconfigured DNSSEC can make a domain completely unresolvable. Key rollovers must be planned carefully. However, managed DNS providers have made DNSSEC much easier to deploy. For high-value domains, the protection against DNS-level attacks is worth the setup effort.
How to Verify
A DNS health checker verifies whether DNSSEC is enabled for your domain and whether the signatures are valid. It checks the DS record at the registrar, the DNSKEY and RRSIG records in your zone, and the complete chain of trust from the root. If DNSSEC is partially configured, the checker will identify the break point.
Check DNS Health