What Is DNSSEC?

Authenticating DNS data

DNSSEC allows signed DNS data to be checked through a chain of trust. The useful distinction is authenticity and integrity of the DNS answer, rather than secrecy. Someone observing an ordinary DNS exchange may still see the queried name and response. DNSSEC is therefore different from encrypting DNS transport or protecting the contents of an email message.

In an email environment, DNS carries routing and authentication information. A validating resolver can reject a response whose DNSSEC validation fails. That makes the relationship between the signed zone, its keys and the parent's delegation important. An otherwise correct MX or TXT value may become unusable to validating clients if the trust configuration is broken.

A migration failure to recognize

A team can move authoritative DNS hosting while leaving an incompatible delegation signer record at the parent. Some clients may then fail to resolve names that other clients appear to resolve. The difference is not proof that the mailbox provider is selectively blocking mail. It may be a validation problem before the mail system can discover the intended destination or authentication data.

Keep the boundary clear

For a planned change, document the current signing arrangement, provider instructions, responsible account and recovery path. Test with validating and authoritative tools, keeping the exact query, response and timestamp. Treat a DNSSEC error differently from an absent TXT record; publishing the same text repeatedly does not repair a broken trust chain.

DNSSEC does not tell a recipient that a salesperson is legitimate, that an address belongs to a particular person or that a message deserves inbox placement. Those are separate decisions. Its role is narrower and valuable: helping a validating resolver determine whether DNS data can be accepted as authentic within the configured chain of trust.