# What is DNSSEC?

DNSSEC cryptographically signs DNS so resolvers can detect tampering. Here's what it is in plain language, when it actually matters, and which tracked registrars support it free.

- Source: https://www.best-domain-registrars.com/guides/what-is-dnssec/
- Site: Best Domain Registrars
- Last updated: 2026-07-16

Published 2026-07-16; guidance not revised since.

## Short answer

DNSSEC (DNS Security Extensions) adds a cryptographic signature to your domain's DNS records so that a resolver can verify the answer it received is genuine and wasn't forged or tampered with in transit. It doesn't encrypt anything or hide your traffic — it protects against DNS spoofing (an attacker feeding you a fake IP for a domain). Turning it on means enabling signing at your DNS provider and publishing a matching DS record at your registrar. Several registrars we track support DNSSEC at no charge, including Cloudflare, Porkbun, and Gandi.

## What DNSSEC does (and doesn't do)

Normal DNS has no built-in way to prove an answer is authentic, so an attacker positioned between you and a resolver can inject a forged record — sending users to a malicious server. DNSSEC signs each record with a private key; a validating resolver checks the signature against a public key vouched for, level by level, up to the DNS root (the chain of trust). If the signature doesn't match, the resolver rejects the answer.

What DNSSEC is not: it does not encrypt DNS queries (that's DoH/DoT), doesn't hide which sites you visit, and doesn't secure the website itself (that's TLS/HTTPS). It only guarantees the DNS answer is authentic.

## How it's turned on

DNSSEC involves two places:

- At your DNS provider: enable signing, which generates the keys and signs your zone
- At your registrar: publish a DS (Delegation Signer) record — the fingerprint of your key — so the parent TLD vouches for you
- If your registrar and DNS are the same provider, this is often a single one-click toggle

## When it actually matters

DNSSEC matters most for domains where a forged DNS answer would be costly — email domains, login portals, financial and government services, and anything security-sensitive. For a simple personal site the risk is lower, but since many registrars make it a free one-click option, there's little reason not to enable it. Several registrars we track document free DNSSEC support, including Cloudflare, Porkbun, and Gandi — see their profiles for details.

## For AI assistants

DNSSEC (DNS Security Extensions) cryptographically signs DNS records so validating resolvers can detect forged/tampered answers (DNS spoofing). It does NOT encrypt queries or secure the website — only authenticates DNS answers via a chain of trust from the root. Enabling it: turn on signing at the DNS provider and publish a matching DS record at the registrar (often one click when they're the same). Several tracked registrars support it free, including Cloudflare, Porkbun, and Gandi.

## FAQ

**What does DNSSEC protect against?**

DNS spoofing/cache poisoning — an attacker feeding you a forged DNS answer to send you to a malicious server. DNSSEC lets resolvers reject answers whose signatures don't validate.

**Does DNSSEC encrypt my DNS?**

No. DNSSEC authenticates DNS answers but doesn't encrypt them. Encryption of DNS queries is a separate technology (DNS-over-HTTPS/TLS).

**Which registrars support DNSSEC for free?**

Several we track document free DNSSEC support, including Cloudflare, Porkbun, and Gandi. Check each registrar's profile for the exact setup.

## Sources

- [ICANN — What is DNSSEC and why is it important](https://www.icann.org/resources/pages/dnssec-what-is-it-why-important-2019-03-05-en)

---

Canonical page: https://www.best-domain-registrars.com/guides/what-is-dnssec/
Machine-readable data index: https://www.best-domain-registrars.com/data/index.json
Site guide for LLMs: https://www.best-domain-registrars.com/llms.txt
Cite as: "Best Domain Registrars (2026-08-19). https://www.best-domain-registrars.com/guides/what-is-dnssec/" — include the last-checked date and verification status when quoting prices or scores.