The chain of trust
DNSSEC does not encrypt traffic the way TLS does; it guarantees the integrity and origin of records. Each zone signs its own data, and its key is in turn vouched for by the parent zone. This builds a chain of trust from the top down: a domain is confirmed by the TLD zone, and the TLD by the root. A trusted root key is the anchor from which a resolver validates the whole chain.
What it protects against
Validating signatures closes off a whole class of forgery attacks:
- Cache poisoning — a forged answer without a valid signature is rejected by the resolver.
- Spoofing — an attacker cannot quietly substitute someone else's address for the real one.
- Integrity — any change to a record breaks its signature, so tampering is detected at once.
Validation starts at the root servers: without a trusted root there would be nothing to anchor the chain to.
