DNSSEC
Learn how DNSSEC uses DS, DNSKEY, and RRSIG records to authenticate DNS answers, what each record means, and how to check whether a domain publishes DNSSEC evidence.
What Is DNSSEC?
TL;DR DNSSEC adds cryptographic signatures to DNS so resolvers can verify that DNS answers were not changed in transit. A working DNSSEC chain usually has a DS record at the parent zone, DNSKEY records at the signed zone, and RRSIG records that sign DNS record sets.
The Records That Matter
- DS: Published in the parent zone. It points to the child zone's key and connects the delegation to the DNSSEC chain of trust.
- DNSKEY: Published by the signed zone. These public keys let validators verify signatures.
- RRSIG: The signature over a DNS record set. Validators use DNSKEY records to verify these signatures.
How To Check DNSSEC
Use the DNSSEC Checker for a combined DS, DNSKEY, and RRSIG check. For individual records, you can also query:
dig example.com DS
dig example.com DNSKEY +dnssec
dig example.com RRSIG +dnssecCommon Problems
- DNSKEY exists but DS is missing: The zone may be signed locally, but the parent has not been updated, so the chain of trust is incomplete.
- DS exists but DNSKEY does not match: The parent points at a key that is missing or rotated incorrectly. This can cause validating resolvers to fail.
- RRSIG is missing: The zone may not be fully signed, or the resolver may not be returning DNSSEC data.