DNSSEC

DNS was designed to distribute naming data efficiently, not to prove that the data is authentic. A resolver can receive an answer saying:

but ordinary DNS alone does not give it cryptographic proof that the answer came from the operator of example.com and remained unchanged.

The Domain Name System Security Extensions, or DNSSEC, add that proof. A zone publishes public keys and digital signatures alongside its DNS records. A validating resolver uses those signatures to determine whether an answer is authentic.

DNSSEC provides three main capabilities:

DNSSEC does not encrypt queries or responses. Anyone able to observe the DNS exchange can still see the names and records being sent. Its purpose is to make forged or modified DNS data detectable.