DNSSEC: what it protects — and what it does not

Plain DNS answers are just packets — anyone in the path can forge one, and the resolver has no way to tell. DNSSEC adds signatures: your zone publishes public keys (DNSKEY) and signs every answer (RRSIG). A validating resolver checks the signature and rejects forgeries.

It is NOT encryption: answers stay readable by anyone. DNSSEC proves the answer was not tampered with — it does not hide it.

The chain of trust

Signatures alone prove nothing — an attacker could sign with their own key. Trust comes from a chain: the root zone vouches for .com, .com vouches for your domain via a DS record, and your DNSKEY signs the answers. Break any link and validating resolvers return SERVFAIL: for them, your domain stops existing.

dig example.com A +dnssec   # o flag "ad" indica resposta validada

The failure mode nobody tells you about

Broken DNSSEC is worse than no DNSSEC. Expired signatures, a DS at the registrar pointing at a key you no longer serve, turning DNSSEC off without removing the DS — each of these takes your domain offline for every validating resolver (which today is most of them), while looking fine on resolvers that skip validation. The symptom is "works for some people": the worst kind of outage to debug.