Blog

Trends

What Is DNSSEC, and How Does It Work?

Sam Preston is an Engagement Manager at Akamai and a member of Akamai’s Edge DNS product line expert team. He and his family live in Boise, Idaho, with an unruly dog, Midnight, and plants they rarely remember to water. You can read all of his prior articles on Akamai DNS solutions.

DNSSEC helps protect your domain against cache poisoning and answer forgery. It’s a crucial addition to your domain.

Originally published March 19, 2021; updated April 2025

Contents

\r\n \r\n Facilitate signature validation using DNS records

\r\n Should I enable DNSSEC on my domain?

\r\n Grouping DNS records into RRSets

\r\n Resource record signatures

\r\n Zone signing keys

\r\n Key signing keys

\r\n Delegation signer records

\r\n NSEC and NSEC3

\r\n DNSSEC modes of operation \r\n Offline signing of static zones

\r\n Centralized online signing

\r\n On-the-fly signing

\r\n \r\n

\r\n Risks of incorporating DNSSEC \r\n Three-way handshake required

\r\n \r\n

\r\n…