What does DNSSEC stand for?
DNSSEC stands for Domain Name System Security Extensions. Extensions that let DNS responses be digitally signed so resolvers can verify records were not forged or altered, defeating cache poisoning. It provides authenticity and integrity only; it does not encrypt queries, which is what DoT and DoH do.
DNSSEC adds digital signatures to DNS data. A zone signs its records with a private key and publishes the public key; a hash of that key is published in the parent zone, which builds a chain of trust up to the root. A validating resolver checks the signatures and rejects answers that were altered or forged. DNSSEC protects the integrity and origin of answers. It does not encrypt them: queries and responses can still be read on the wire.
DNSSEC in practice: an example
An attacker tries to poison a resolver's cache with a forged address for a bank's domain. The zone is signed, the forged answer carries no valid signature, and the validating resolver discards it and returns an error instead of the attacker's address.
What DNSSEC is confused with
DNSSEC vs DoH: what is the difference?
DoH and DoT encrypt the conversation between a client and its resolver, so others cannot read or change it in transit. DNSSEC proves the records themselves are authentic, whichever path they travelled. They solve different problems and can be used together. What DoH stands for
DNSSEC vs DNS: what is the difference?
DNS is the lookup system; DNSSEC is an extension that adds signatures to it. A domain without DNSSEC still resolves, it just cannot prove that its answers are genuine. What DNS stands for
Which exams cover DNSSEC?
DNSSEC is on the official CompTIA acronym list for one of the four exams covered here.
- Network+ N10-009: 3.0 (Network Operations).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. Which threat is DNSSEC designed to stop?
- Eavesdropping on DNS queries
- Forged DNS answers, such as cache poisoning
- Denial-of-service floods
- Weak Wi-Fi passwords
Show the answer
B. Forged DNS answers, such as cache poisoning. DNSSEC signs records so a resolver can detect a forged or modified answer. It provides no confidentiality, so it does nothing against eavesdropping.
2. After a registrar change, a signed domain stops resolving for users of validating resolvers but works elsewhere. What is the most likely cause?
- The DS record in the parent zone no longer matches the zone's key
- The web server certificate expired
- The TTL is too long
- The domain uses IPv6
Show the answer
A. The DS record in the parent zone no longer matches the zone's key. Validation follows the chain from the parent's DS record to the zone's key. If they no longer match, validating resolvers treat every answer as bogus while non-validating ones carry on.
Sources: RFC 4033: DNS Security Introduction and Requirements; RFC 9364: DNS Security Extensions (DNSSEC); NIST glossary: Domain Name System Security Extensions; NIST SP 800-81-2, Secure Domain Name System (DNS) Deployment Guide. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.