DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS records, ensuring that responses haven't been tampered with during transit. Without DNSSEC, attackers can hijack DNS queries (DNS spoofing/cache poisoning) and redirect users to malicious websites. DNSSEC creates a chain of trust from the root zone down to individual domains, making the DNS infrastructure significantly more secure.

DNSKEY — The public key published by a zone, used to verify RRSIG signatures. There are two types: Zone Signing Key (ZSK) for signing zone data, and Key Signing Key (KSK) which signs the DNSKEY set and is referenced by DS records.

DS (Delegation Signer) — A hash of the child zone's KSK, stored in the parent zone. It creates the trust link between parent and child zones. If the DS digest matches the child's DNSKEY, the chain is intact.

RRSIG — The actual digital signature for a specific set of DNS records (e.g., RRSIG for A records). It's generated using the ZSK and verified against the zone's DNSKEY.

The DS record contains a cryptographic hash of the child zone's KSK (DNSKEY with flags=257). Verification involves: 1) Extracting the KSK's raw public key data, 2) Prepending the owner domain name in wire format, 3) Computing the hash (SHA-1 for digest type 1, SHA-256 for type 2, SHA-384 for type 4), and 4) Comparing the result with the DS digest. A match confirms that the parent zone authorizes this DNSKEY for the child zone.

If no DNSKEY records are found, the domain is not DNSSEC-signed. This means DNS responses for this domain lack cryptographic protection and are vulnerable to spoofing attacks. To enable DNSSEC, you need to sign your zone (most DNS hosting providers offer this as a one-click option) and publish the corresponding DS record with your domain registrar (parent zone).

DNSSEC protects against data integrity attacks like cache poisoning and man-in-the-middle DNS manipulation. However, it does not provide encryption (DNS queries are still sent in plaintext unless combined with DNS-over-HTTPS or DNS-over-TLS). DNSSEC also doesn't protect against DDoS attacks on DNS servers or registry-level compromises. It's one important layer in a comprehensive DNS security strategy.

A Key Tag is a 16-bit numeric identifier that helps quickly match DNSKEY records with their corresponding DS and RRSIG records. It's computed from the DNSKEY RDATA using a checksum algorithm defined in RFC 4034 Appendix B. The key tag appears in DS records (to identify which KSK is being referenced) and in RRSIG records (to identify which ZSK/KSK generated the signature), enabling efficient lookups.

Best practices recommend rotating the ZSK every 1–3 months and the KSK every 1–2 years. ZSK rotation is simpler since it doesn't require updating the parent zone's DS record. KSK rotation requires careful coordination with your registrar to update the DS record — a double-signature approach is recommended to avoid breaking the trust chain during transition. Many managed DNS providers handle this automatically.

Common failures include: Expired RRSIG signatures (the zone wasn't re-signed in time), DS digest mismatch (the parent's DS record doesn't match the child's current KSK — often after an incomplete key rollover), Missing DNSKEY for a key tag referenced by RRSIG or DS, Clock skew causing valid signatures to appear expired, and broken chain of trust where intermediate zones lack proper DS records. This tool helps identify many of these issues by cross-referencing records.