Root
The top of the DNS tree. Root servers help resolvers find the right TLD.
DOMAIN INFRASTRUCTURE & SECURITY
DNS & DNSSEC
Understand How Your Domain Connects — and How DNSSEC Helps Protect It
DNS connects your domain name to websites, email and online services. DNSSEC adds cryptographic validation that helps users and resolvers trust the DNS information they receive.
Foundation
What Is DNS?
DNS stands for Domain Name System. It translates human-readable domain names such as example.com into information computers can use, such as 93.184.216.34.
Think of the domain as the address people remember, the IP as the address computers use, and DNS as the system that connects them.
Domain Name
example.com
Easy for people to remember.
DNS
Lookup system
Looks up where the domain should point.
IP Address
93.184.216.34
Helps devices locate the server.
Resolution
How DNS Works
What happens after someone enters your domain into a browser?
01
User
Someone enters example.com in a browser or app.
02
Recursive Resolver
The recursive resolver starts the lookup if the answer is not already cached.
03
Root Servers
Root DNS points the resolver toward the correct top-level domain.
04
TLD Servers
The TLD zone directs the resolver to the domain’s authoritative nameservers.
05
Authoritative DNS
Authoritative servers hold the domain’s published records and return the answer.
06
IP / Service Data
The resolver receives the IP address or other record needed for the request.
07
Website / Service
The client uses that answer to reach the website, mail system or other service.
Structure
DNS Is a Global Hierarchy
DNS is organized as a tree — from the root down to your domain’s authoritative zone.
Root (.)
.COM
.AM
.GE
Authoritative Nameservers
example.com
TLD
Top-level domains such as .com, .am or .ge manage delegations for their namespaces.
Authoritative
Authoritative servers publish the records that define where your domain points.
Recursive
Recursive resolvers walk the hierarchy on behalf of users and cache answers.
Record Types
The Building Blocks of DNS
These records tell the internet how your domain should connect to services.
IPv4 address
Maps a hostname to an IPv4 address.
example.com → 93.184.216.34
IPv6 address
Maps a hostname to an IPv6 address.
example.com → 2606:2800:220:1:248:1893:25c8:1946
Canonical name
Aliases one hostname to another hostname.
www.example.com → example.com
Mail exchange
Directs email for the domain to mail servers.
example.com → mail.example.com
Text data
Publishes verification, SPF, DKIM and other text policies.
v=spf1 include:_spf.example.com ~all
Nameserver
Delegates the zone to authoritative nameservers.
example.com → ns1.example.net
Impact
DNS Powers More Than Your Website
DNS is the routing layer behind how people and systems find your online presence.
Website
A and AAAA (and related) records decide which servers answer for your site.
MX and supporting TXT records guide mail delivery and authentication checks.
Services
APIs, CDNs, verification tokens and SaaS tools often depend on DNS entries.
Domain Infrastructure
NS records and zone data define who publishes authoritative answers for the domain.
Security Extensions
What Is DNSSEC?
DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS data so a validating resolver can verify that answers are authentic and have not been tampered with.
Without DNSSEC
- DNS answers can be looked up, but not cryptographically validated
- A forged response may look like a normal answer
- Trust relies mainly on the network path and caching behavior
With DNSSEC
- Signed DNS data can be validated
- Invalid signatures can be rejected
- A chain of trust links root → TLD → domain
Clarification
DNSSEC Does Not Replace DNS
DNS + DNSSEC = DNS with validation
DNS still publishes and resolves records. DNSSEC adds a verification layer on top of that data.
What DNSSEC is
A way to help validating resolvers confirm that DNS answers match the signed zone data in the chain of trust.
What not to assume
DNSSEC does not encrypt website traffic, replace HTTPS/TLS, hide IP addresses or make DNS private.
Comparison
DNS vs DNSSEC
DNS finds the answer. DNSSEC helps verify the answer.
DNS
- Resolves names to records
- Connects domains to sites, mail and services
- Does not cryptographically validate answers by itself
DNSSEC
- Signs DNS data with cryptographic keys
- Lets validating resolvers check authenticity
- Helps detect tampered or forged signed responses
Validation Path
How DNSSEC Builds Trust
A DNSSEC-aware validating resolver checks signatures along the chain of trust before accepting an answer.
01
Query
A client asks for DNS data for a signed domain.
02
Validating Resolver
A DNSSEC-aware recursive resolver requests answers and related signatures.
03
Signed Answer
The authoritative zone returns records plus RRSIG signatures.
04
DNSKEY
The resolver obtains the zone’s public keys published as DNSKEY records.
05
DS at Parent
A DS record in the parent zone links the child key into the hierarchy.
06
Chain Check
Validation continues upward through TLD and root trust anchors as needed.
07
Signature Verify
The validating resolver checks that signatures match the returned data.
08
Accept or Reject
Valid answers are accepted; failed validation can cause the response to be rejected.
Trust Model
The DNSSEC Chain of Trust
Each link authenticates the next — from the root down to your domain’s signed data.
Root DNSKEY
Trust anchor
DS
Points to TLD
TLD DNSKEY
Parent zone key
DS
Points to domain
Domain DNSKEY
Child zone key
RRSIG
Signs records
Validated
Trusted answer
DNSSEC Records
Important DNSSEC Records
These records make cryptographic validation possible.
Zone public key
Publishes the public key used to verify signatures for a signed zone.
example.com DNSKEY …
Delegation signer
Published in the parent zone to securely link a child DNSKEY into the chain.
example.com DS 2371 13 2 5A8F…
Signature set
Carries the cryptographic signature covering a set of DNS records.
example.com RRSIG A …
How they connect
DNSKEY signs zone data via RRSIG. DS at the parent authenticates the child DNSKEY. Together they form the validation path.
Why It Matters
Why DNSSEC Matters
DNSSEC helps protect, detect and prevent certain classes of DNS integrity attacks — it is not a complete security solution by itself.
Spoofing
Helps detecting forged DNS answers that fail signature checks at a validating resolver.
Cache poisoning
Helps prevent accepting poisoned cache entries when validation fails for signed data.
Tampered data
Helps detect modified DNS records that no longer match their cryptographic signatures.
Domain redirection
Helps protect users from being silently redirected via forged DNS destinations.
Integrity Check
What Happens When DNS Is Attacked
A simple view of how validation changes the outcome of a forged answer.
Without DNSSEC
Fake answer accepted
An attacker injects a forged DNS response. Without signatures to check, a resolver may accept the fake answer and send users to the wrong destination.
No cryptographic validation of the DNS answer
With DNSSEC
Invalid rejected / valid accepted
A validating resolver checks signatures. Invalid or tampered answers can be rejected; properly signed answers can be accepted with higher confidence.
Signature check before trusting the answer
Layers
DNSSEC and HTTPS Protect Different Things
They secure different layers. Together they are stronger.
DNS answer integrity
Helps validating resolvers confirm that DNS records are authentic and untampered.
Connection security
Encrypts and authenticates the connection between a client and a web server.
DNSSEC does not replace TLS
Use DNSSEC to strengthen DNS trust where supported, and HTTPS to protect website sessions. One does not replace the other.
Honest Limits
What DNSSEC Does — and Does Not — Protect
Clear boundaries build trust. DNSSEC is powerful within the DNS layer — and only there.
DNSSEC helps
- Validate DNS responses
- Detect modified signed DNS data
- Establish a chain of trust
- Reduce certain spoofing risks
DNSSEC does not
- Encrypt website traffic
- Replace HTTPS
- Protect weak passwords
- Secure application code
- Prevent every cyberattack
GlobalR
Manage DNSSEC With GlobalR
For supported domains, GlobalR lets you manage DNSSEC DS records in the domain management interface. Availability depends on the domain extension and registry support.
Your DNS provider typically signs the zone and supplies DS details. You configure those DS values in GlobalR so the parent registry can publish them. GlobalR does not invent automatic key generation on this page.
Overview
DNSSEC Records
Nameservers
Illustrative preview — not live domain status.
| Field | DS Record #1 | |
|---|---|---|
| Key Tag | 2371 | |
| Algorithm | 13 | |
| Digest Type | 2 | |
| Digest | 5A8F… | Edit |
DS Record #2
Add DNSSEC Record
Save Changes
Flexibility
Support for Multiple DS Records
Some DNSSEC configurations use multiple DS records — for example during key changes or depending on registry configuration.
DOMAIN DNSSEC
├── DS Record 1 ├── DS Record 2 └── DS Record 3
Activation
How DNSSEC Configuration Typically Works
Exact steps vary by DNS hosting provider, registry and TLD.
01
DNS Provider
Signs the DNS zone and prepares DNSSEC material.
02
DS Info
Provides DS / DNSSEC details needed at the parent.
03
GlobalR
DS record configured for a supported domain.
04
Registry
Parent zone publishes the DS information.
05
Validating Resolver
Can validate the chain of trust for signed answers.
Provider and TLD variance
Workflows differ across DNS hosts and registries. DNSSEC availability depends on the domain extension and registry support — GlobalR does not promise DNSSEC for every extension.
Use Cases
Who Benefits From DNSSEC?
DNSSEC is especially useful wherever forged DNS responses would cause serious trust or brand harm.
Business websites
Add another layer of DNS trust for company domains.
Financial / commerce
Useful where domain integrity matters strongly for transactions and accounts.
Customer portals
Helps protect DNS trust around login and account service hostnames.
Email domains
Can contribute to a stronger DNS security posture. Enabling DNSSEC alone does not secure email content.
Brand-critical domains
Helps reduce risks associated with forged DNS responses for high-value brands.
Public services
Useful for domains where authenticity of the destination is particularly important.
Illustrative Status
Domain Security at a Glance
Example panel only — not live monitoring of a real domain.
Domain Security
example.com
DNS
● Active
Nameservers
● Connected
DNSSEC
● Enabled
DS Records
2
Chain of Trust
✓ Valid
Last Check
Recently
FAQ
Frequently Asked Questions
Short answers about DNS, DNSSEC and managing DS records with GlobalR.
What is DNS?
DNS (Domain Name System) translates human-readable domain names such as example.com into machine-usable answers like IP addresses, mail servers and other service records.
Why does my domain need DNS?
Without DNS, browsers and apps cannot look up where your domain should point. DNS connects your domain to websites, email and other online services.
What is a DNS record?
A DNS record is a published instruction for a domain—such as A, AAAA, CNAME, MX, TXT or NS—that tells resolvers how to find a service or related name.
What is the difference between A and CNAME records?
An A record maps a name directly to an IPv4 address. A CNAME maps a name to another hostname, which is then resolved further.
What is DNSSEC?
DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures so validating resolvers can verify that DNS answers are authentic and have not been tampered with in transit.
Does DNSSEC replace DNS?
No. DNSSEC extends DNS with validation. You still need DNS to publish and resolve records; DNSSEC helps confirm those answers are trustworthy.
Does DNSSEC encrypt DNS traffic?
No. DNSSEC signs DNS data for authenticity and integrity. It does not encrypt DNS queries or website traffic.
Does DNSSEC replace HTTPS?
No. DNSSEC helps validate DNS answers. HTTPS/TLS encrypts and authenticates the connection to a web server. They protect different layers and work best together.
What is a DS record?
A DS (Delegation Signer) record is published in the parent zone. It links a child domain’s DNSKEY into the DNSSEC chain of trust.
What is DNSKEY?
A DNSKEY record publishes a public key used in a DNSSEC-signed zone so resolvers can verify signatures for that zone’s data.
What is RRSIG?
An RRSIG record is a cryptographic signature that covers a set of DNS records (an RRset), allowing a validating resolver to check that the data matches the zone’s keys.
What is the DNSSEC chain of trust?
The chain of trust is the linked path of keys and DS records from the DNS root down through TLDs to your domain, letting a validating resolver prove answers are authentic.
Can every domain use DNSSEC?
DNSSEC availability depends on the domain extension and registry support. Your DNS provider and registrar workflow must also support signing and DS publication.
Can I configure multiple DS records?
Yes. Some setups use multiple DS records—for example during key changes or based on registry requirements. GlobalR supports managing multiple DS records where DNSSEC is available.
How do I manage DNSSEC in GlobalR?
For supported domains, sign in to your GlobalR account, open the domain’s DNSSEC settings and configure the DS record details provided by your DNS provider. DNSSEC availability depends on the domain extension and registry support.
Next Step
Give Your Domain a Stronger DNS Foundation
Understand your DNS configuration, manage your domain infrastructure and add DNSSEC validation where supported.
DNSSEC availability depends on the domain extension and registry support.