What is DNSSEC

DNSSEC adds data origin authentication and data integrity to DNS. A resolver can check that the answer was signed by the zone. The extensions do not provide confidentiality.

RFC 4033 names the records a security-aware name server includes when the resolver asks: RRSIG, DNSKEY, DS, and NSEC. The record formats are in RFC 4034.