DNSSEC lets validating resolvers verify signed DNS data. It authenticates answers but does not encrypt queries or prove that a website is safe.

What validating resolvers gain

DNSSEC lets a supporting resolver check that the answer came from the zone owner. Not every resolver validates. Signing still authenticates the zone for those that do.

The delivery model

How it works

DNSSEC explained

  1. 01SignThe zone publishes signed records and DNSKEY data.
  2. 02Delegate trustThe parent publishes a matching DS record.
  3. 03ValidateA resolver checks the chain and signatures.
Conceptual model for this configuration. The actual path depends on provider policy and application behavior.

DS at the parent

Enabling DNSSEC on Cloud DNS is not finished until DS records are published at the parent. Test with a validating resolver before you treat production as signed.

Low TTLs and signatures

Record cache lifetimes, signature validity, and key rollover are separate concerns. Keep signatures valid for the intended operational window and verify the chain during planned changes.

Vanity nameservers

Branded NS records are supported. Include glue and DS in the plan so the branded names remain valid.

Validate before production

Validate the full chain before and after delegation or key changes. Compare a validating resolver with a diagnostic direct query. Keep a documented key-rollover plan and coordinate DS changes with the registrar to avoid a broken chain.

  • Record the configuration and expected result before changing traffic.
  • Keep evidence of the test and a working rollback for the previous behavior.

Sources & further reading