DNSSEC (Domain Name System Security Extensions)
Cryptographic signatures on DNS records that let resolvers verify a response is authentic and was not forged or tampered with in transit.
- glossary
DNSSEC (Domain Name System Security Extensions) is a set of cryptographic extensions to the DNS protocol that lets resolvers verify the authenticity and integrity of DNS responses. Without DNSSEC, an attacker can forge or tamper with DNS replies on the path between resolver and authoritative server, redirecting users to malicious infrastructure. With DNSSEC, the records are signed, and a chain of trust runs from the DNS root down through each zone via DS records. DNSSEC is specified in RFC 4033 and related RFCs. Tokenizing a domain doesn't change DNSSEC at all — the chain of trust still runs through the registrar and registry, and DS records are published the same way. Many DNS providers (Cloudflare, Route53) sign zones automatically when DNSSEC is enabled.
Related keywords
- DNSSEC
- DNS security
- domain security
- DS record
- chain of trust
- cryptographic DNS
Contributors
Namefi is a collective of engineers, designers, and operators who obsess over building tools that make managing your onchain domain names effortless.
Victor Zhou is a technology founder and standards editor focused on digital identity and trust. He founded Namefi, edits Ethereum Improvement Proposals, and previously led smart-contract architecture work at Google Labs.
His work sits at the intersection of naming, ownership, and the systems people use to establish identity online. That perspective makes him especially interested in the way names move between personal meaning, public recognition, and digital infrastructure.
For Namefi, Victor edits and writes about domains as durable digital identity: how names become ownable onchain assets, how tokenization changes custody and trust, and what naming can learn from the systems people use to establish identity online.