DNSSEC

The abstract of RFC 4033 says the extensions add data origin authentication and data integrity to the DNS. A security-aware resolver uses the new record types to tell a signed answer from an unsigned one, and a validating resolver checks the signature.

The same introduction says these extensions do not provide confidentiality. DNSSEC is not designed to hide the query or the answer.

Section 9 says a security-aware name server should include RRSIG, DNSKEY, DS, and NSEC in responses to resolvers that set the DO bit, subject to message size. Those names are the core set in this document. RFC 4034 specifies the record formats. RFC 4035 specifies the protocol changes.

A signed zone has to be re-signed. Each RRSIG has a validity period, and re-signing changes the SOA serial. An expired signature is not a permanent property of the name. It is a maintenance failure.

Responses from an island of security can only be authenticated if its keys are authenticated by some trusted means outside the DNS protocol. A signed zone whose parent was never linked with a DS record does not become trusted because the signatures verify locally.