What is DNSSEC and why is it important for DNS integrity?

• A. DNS Security Extensions; signs DNS data to prevent spoofing and data manipulation.
• B. A method to compress DNS queries.
• C. A DNS caching mechanism to speed lookups.
• D. A protocol for IP address assignment.

Answer: (A)

DNSSEC adds digital signatures to DNS data so you can verify that the information you receive truly comes from the stated DNS zone and hasn’t been altered in transit. It signs DNS records with private keys and provides those signatures alongside the data, while resolvers use published public keys (in DNSKEY records) to validate them. A chain of trust is built from the root down through parent zones via DS records, so a validating resolver can confirm that a response is authentic all the way from the root to the authoritative source. This authentication is what protects against spoofing, cache poisoning, and other tampering that could mislead users or redirect them to malicious sites. It’s important to emphasize that DNSSEC ensures integrity and origin authentication, not confidentiality or encryption of the DNS query/response data. Deploying DNSSEC requires coordination across zones and resolvers, careful key management (including key rollovers), and awareness of potential performance and larger response sizes. This option describes a signing mechanism, not a compression method, caching mechanism, or IP-address assignment protocol.