Every DNS answer cryptographically verified
Trust that runs up to the registry
SPF, DKIM and DMARC all live in DNS
DNS was built to be trusting: attackers abuse that
DNS is the internet’s address book: it turns a name like yourdomain.com into the actual servers that handle your mail and your website. The problem is that classic DNS has no way to prove an answer is genuine. When a receiver looks up your records, it generally trusts whatever reply comes back, and an attacker who can slip a forged answer into that conversation can quietly redirect your traffic.
That’s the basis of DNS spoofing and cache poisoning: feeding a resolver a fake answer so that mail meant for you, or visitors to your website, are silently sent to a server the attacker controls. DNSSEC (DNS Security Extensions) shuts that down. It adds a chain of cryptographic signatures to your DNS, so a receiver can verify the answer genuinely came from you and wasn’t altered on the way, and reject it if it was forged.
Why this matters, whoever you are
- Every email control (SPF, DKIM, DMARC) lives in DNS, so DNSSEC underpins all of them.
- Running your own domains? An attacker can’t forge a DNS answer to reroute your mail or your website without it being detected.
- Managing clients? It’s a foundational hardening step you can verify and switch on across the domains you protect.
How it works: a chain of trust
DNSSEC works by signing your DNS records with cryptographic keys, then linking those keys upward so the whole thing can be traced to a source everyone already trusts. A resolver checks each link in the chain, and if any signature doesn’t add up, it treats the answer as forged and refuses it.
Signatures, keys and the DS record
When DNSSEC is enabled, each set of records in your zone gets a digital signature. Those signatures are produced by your signing keys, and a small fingerprint of your key, the DS (Delegation Signer) record, is published with your registry one level up. That link is what makes the chain unbroken: your registry vouches for your key, your key vouches for your records.
A DS record at the registry looks roughly like this:
example.com. DS 12345 13 2 49FD46E6C4B45C55D4AC...
A resolver follows that chain from the trusted root down to your records, verifying a signature at every step before it believes the answer.
What a resolver checks
- That your records carry a valid signature
- That the signing key matches the published fingerprint
- That the registry’s DS record links the chain upward
- That the chain runs unbroken to the trusted root
- If any link fails, the answer is rejected, not used
Powerful, and unforgiving
DNSSEC’s strictness is the whole point, but it cuts both ways. Because a resolver rejects any answer whose signatures don’t validate, a broken DNSSEC setup doesn’t just weaken protection: it can take your entire domain offline. Mail stops, the website disappears, and to the outside world it looks as if the domain itself has failed.
The usual causes are signatures left to expire, keys rotated incorrectly, or a DS record at the registry that no longer matches the keys actually signing the zone, often after a DNS provider change. This is exactly why DNSSEC needs to be set up carefully and watched continuously, not switched on and forgotten.
Where it goes wrong
- Signatures allowed to expire, breaking the chain
- Keys rotated without updating the DS record
- A DS record that no longer matches the signing keys
- A provider migration that breaks the chain of trust
- A broken setup taking the whole domain offline
How DMARCER helps
DMARCER checks whether DNSSEC is enabled on your domains and validates that the chain of trust is genuinely sound, not just present, but unbroken from the registry down. On supported DNS providers, it can enable DNSSEC for you, taking the risk out of a setup that’s powerful but easy to get wrong. And because a broken signature can take a domain offline, it keeps watching: as part of DNS remediation it warns you the moment a signature breaks or the chain falls apart, so you can act before your mail and website disappear. For a business that’s a foundational protection made safe to adopt; for an MSP it’s the same check and fix, applied consistently across every client.
Related
DNS remediation →
Enable and monitor DNSSEC and more.
DNSSEC checker →
Check your chain of trust free, in seconds.
DMARC →
The DNS-based control DNSSEC protects.
See whether your DNSSEC is sound
Run a free check to see your domain’s posture, then let DMARCER enable DNSSEC and warn you the moment a signature breaks.
Check your domain