Can anyone prove your DNS answers are real?

What it protects against

When something looks up your domain, it asks a resolver, which asks other servers. Without DNSSEC, none of those answers carries proof of origin. A forged reply — injected into a resolver's cache, or supplied on a network somebody else controls — is accepted as readily as a real one.

The consequence is not subtle. Traffic for your domain goes wherever the forged answer says: a copy of your site, or a mail server that is not yours. DNSSEC makes those answers verifiable, and a validating resolver refuses anything that fails.

Why it needs two companies

This is the practical obstacle, and it explains most half-finished deployments.

• Your DNS operator signs the zone and publishes the keys. Many will do this with one switch.
• Your registrar publishes a DS record at the registry, which is what tells the rest of the internet those keys are the right ones.

Signing without the DS record achieves nothing — resolvers have no reason to trust the keys. Publishing a DS record that does not match the keys is worse: validating resolvers conclude the answers are forged and return failure. To much of the internet, the domain simply stops existing.

That is the real risk, and it is why this page says worth doing rather than urgent. It is also why the check reports DNSSEC without letting it affect the headline verdict — most domains do not have it, and grading everyone amber for a missing optional control is how a tool teaches people to ignore it.

Doing it safely

1. Find out who operates your DNS. Often not your registrar, and often not who you assume.
2. Enable signing there first, and let it settle.
3. Take the DS record it gives you to your registrar and publish it. If both are the same company, this is usually a single toggle.
4. Verify afterwards, rather than assuming. The check on this site reports whether the delegation is signed at the registry — the half a zone lookup cannot show you.
5. Never change DNS providers with DNSSEC still enabled. Turn it off, migrate, turn it back on. A DS record pointing at keys the new provider does not have is the classic way to take a domain offline.

What it does not do

DNSSEC proves an answer came from the zone's owner and was not altered. It does not encrypt anything, does not stop someone sending mail as you — that is spoofing — and does not protect the registration itself from being transferred away, which is hijacking.

It answers exactly one question: is this reply genuine? That question is worth answering. It is not the first one to answer.