What Is DNSSEC?
DNSSEC — Domain Name System Security Extensions — is a suite of specifications that add cryptographic authentication to DNS responses. Standard DNS was designed in the 1980s without any security mechanisms, meaning DNS responses are inherently unsigned and unverified. Any device between you and the DNS server can alter a DNS response without detection, redirecting you to a malicious server while your browser shows the correct domain name. DNSSEC solves this by adding digital signatures to DNS records that resolvers can verify before returning results to your device.
The way DNSSEC works is through a chain of trust rooted in the DNS root zone. Each level of the DNS hierarchy — from root servers to top-level domains to individual domain names — signs its records with cryptographic keys and publishes the public keys needed to verify those signatures. When a DNSSEC-validating resolver receives a response, it follows this chain of signatures from the root zone down to the specific record, verifying each link. If any signature is invalid or missing where it should exist, the resolver rejects the response entirely rather than returning potentially compromised data.
DNSSEC validation must be performed by your DNS resolver — the server that answers your DNS queries. You cannot enable DNSSEC on your device directly because the validation process requires access to the full chain of DNS records and signatures. This is why your choice of DNS resolver determines whether you benefit from DNSSEC. Public resolvers like Cloudflare 1.1.1.1, Google 8.8.8.8, and Quad9 9.9.9.9 all perform DNSSEC validation. Most ISP DNS resolvers do not, leaving their users vulnerable to DNS spoofing attacks that DNSSEC was specifically designed to prevent.
What Attacks Does DNSSEC Prevent?
DNS Cache Poisoning
Cache poisoning attacks inject forged DNS records into a resolver's cache, causing all users of that resolver to be redirected to attacker-controlled servers. Without DNSSEC, there is no way to distinguish a legitimate cached record from a poisoned one. DNSSEC prevents this because forged records will not have valid cryptographic signatures and will be rejected by validating resolvers. This is considered the most significant attack vector that DNSSEC addresses.
DNS Spoofing
DNS spoofing intercepts DNS queries and returns forged responses before the legitimate response arrives. An attacker on your local network or between you and your DNS resolver can substitute any IP address for any domain name. DNSSEC makes spoofing ineffective because the attacker cannot forge the cryptographic signature that the validating resolver requires. Without DNSSEC, spoofing attacks are trivial on networks where the attacker has any level of access.
Man-in-the-Middle DNS Attacks
A man-in-the-middle attacker who can intercept and modify DNS traffic can redirect any domain to any IP address without the user's knowledge. This enables phishing at scale — the attacker can redirect your bank's domain to an identical-looking login page and capture your credentials. DNSSEC ensures that even if an attacker modifies DNS responses in transit, the cryptographic signatures will not match and the validating resolver will reject the tampered data. Combined with HTTPS certificate validation, DNSSEC provides robust protection against sophisticated DNS manipulation.
DNSSEC vs DNS-over-HTTPS – Understanding the Difference
DNSSEC and DNS-over-HTTPS (DoH) are complementary technologies that solve different security problems. DNSSEC authenticates DNS responses — it proves the data came from the authoritative source and was not tampered with. DoH encrypts DNS queries and responses — it prevents anyone from seeing what domains you are looking up. Neither technology alone provides complete DNS security.
Without DNSSEC, your DNS responses could be forged even if they are encrypted by DoH — encryption prevents eavesdropping but does not verify the source of the data. Without DoH, your DNSSEC-validated queries are still visible to your ISP, network administrators, and anyone monitoring your traffic — authentication does not provide privacy. For comprehensive DNS security, use a resolver that supports both: Cloudflare 1.1.1.1 and Google 8.8.8.8 support DNSSEC validation and DNS-over-HTTPS simultaneously.
A VPN adds a third layer by routing all DNS queries through an encrypted tunnel, preventing your ISP from seeing even the encrypted DoH traffic. Premium VPNs like NordVPN operate their own DNSSEC-validating DNS servers within the VPN tunnel, combining all three layers of DNS protection — encryption in transit, authentication of responses, and routing through private infrastructure. This represents the most complete DNS security configuration available to end users.
How to Enable DNSSEC Validation
Switch to a DNSSEC-Validating Resolver
The simplest way to enable DNSSEC validation is to change your DNS settings to a public resolver that validates DNSSEC. Cloudflare 1.1.1.1 is the fastest option and validates DNSSEC by default. Google 8.8.8.8 also validates DNSSEC and is the most widely used public resolver. Quad9 9.9.9.9 validates DNSSEC and additionally blocks known malicious domains. See our Cloudflare DNS test to check if you are already using Cloudflare.
Use a VPN With DNSSEC Support
When connected to a VPN, your DNS queries are routed through the VPN provider's DNS servers. Some VPN providers operate DNS servers that validate DNSSEC, while others do not. Check your VPN's documentation or run this DNSSEC test while connected to your VPN to verify. Using a VPN with DNSSEC-validating DNS combines the privacy benefits of encrypted DNS routing with the security benefits of authenticated DNS responses.
Verify Your Configuration
After changing your DNS settings, use the test at the top of this page to confirm DNSSEC validation is active. Note that DNS changes may take a few minutes to propagate depending on your operating system and network configuration. If the test still shows "Not Validated" after changing your DNS, try flushing your DNS cache and retesting. On Windows, run ipconfig /flushdns; on macOS, run sudo dscacheutil -flushcache.
When a DNSSEC-validating resolver receives a DNS response with an invalid or missing signature for a domain that should be signed, it returns a SERVFAIL error instead of the potentially compromised IP address. This means your browser will show a connection error rather than silently loading a potentially malicious website. While this can occasionally cause issues with misconfigured domains, it is the correct security behaviour — it is better to fail safely than to connect to a spoofed server. If a legitimate website fails due to DNSSEC issues, the problem is on the domain operator's side, not yours.